Merge branch 'master' into staging

.github/CODEOWNERS

@@ -64,13 +64,18 @@
 /pkgs/development/haskell-modules/generic-builder.nix @peti @ryantm @basvandijk
 /pkgs/development/haskell-modules/hoogle.nix          @peti @ryantm @basvandijk
 
+# Perl
+/pkgs/development/interpreters/perl @volth
+/pkgs/top-level/perl-packages.nix   @volth
+/pkgs/development/perl-modules      @volth
+
 # R
 /pkgs/applications/science/math/R   @peti
 /pkgs/development/r-modules         @peti
 
 # Ruby
-/pkgs/development/interpreters/ruby @zimbatm
+/pkgs/development/interpreters/ruby @alyssais @zimbatm
-/pkgs/development/ruby-modules      @zimbatm
+/pkgs/development/ruby-modules      @alyssais @zimbatm
 
 # Rust
 /pkgs/development/compilers/rust @Mic92 @LnL7

doc/languages-frameworks/python.section.md

@@ -484,10 +484,12 @@ and in this case the `python35` interpreter is automatically used.
 ### Interpreters
 
 Versions 2.7, 3.5, 3.6 and 3.7 of the CPython interpreter are available as
-respectively `python27`, `python35`, `python36`, and `python37`. The PyPy
+respectively `python27`, `python35`, `python36` and `python37`. The aliases
-interpreter is available as `pypy`. The aliases `python2` and `python3`
+`python2` and `python3` correspond to respectively `python27` and
-correspond to respectively `python27` and `python37`. The default interpreter,
+`python37`. The default interpreter, `python`, maps to `python2`. The PyPy
-`python`, maps to `python2`. The Nix expressions for the interpreters can be
+interpreters compatible with Python 2.7 and 3 are available as `pypy27` and
+`pypy3`, with aliases `pypy2` mapping to `pypy27` and `pypy` mapping to
+`pypy2`. The Nix expressions for the interpreters can be
 found in `pkgs/development/interpreters/python`.
 
 All packages depending on any Python interpreter get appended
@@ -1102,7 +1104,7 @@ on `numpy` will be built with `mkl`.
 The following is an overlay that configures `numpy` to use `mkl`:
 ```nix
 self: super: {
-  python36 = super.python36.override {
+  python37 = super.python37.override {
     packageOverrides = python-self: python-super: {
       numpy = python-super.numpy.override {
         blas = super.pkgs.mkl;
@@ -1112,6 +1114,15 @@ self: super: {
 }
 ```
 
+`mkl` requires an `openmp` implementation when running with multiple processors.
+By default, `mkl` will use Intel's `iomp` implementation if no other is
+specified, but this is a runtime-only dependency and binary compatible with the
+LLVM implementation. To use that one instead, Intel recommends users set it with
+`LD_PRELOAD`.
+
+Note that `mkl` is only available on `x86_64-{linux,darwin}` platforms;
+moreover, Hydra is not building and distributing pre-compiled binaries using it.
+
 ## Contributing
 
 ### Contributing guidelines

maintainers/maintainer-list.nix

@@ -256,6 +256,11 @@
     github = "AndrewMorsillo";
     name = "Andrew Morsillo";
   };
+  andersk = {
+    email = "andersk@mit.edu";
+    github = "andersk";
+    name = "Anders Kaseorg";
+  };
   AndersonTorres = {
     email = "torres.anderson.85@protonmail.com";
     github = "AndersonTorres";
@@ -1324,6 +1329,11 @@
     github = "ellis";
     name = "Ellis Whitehead";
   };
+  elohmeier = {
+    email = "elo-nixos@nerdworks.de";
+    github = "elohmeier";
+    name = "Enno Lohmeier";
+  };
   elseym = {
     email = "elseym@me.com";
     github = "elseym";

nixos/doc/manual/release-notes/rl-1903.xml

@@ -43,6 +43,15 @@
      <literal>./programs/nm-applet.nix</literal>
     </para>
    </listitem>
+   <listitem>
+    <para>
+     There is a new <varname>security.googleOsLogin</varname> module for using
+     <link xlink:href="https://cloud.google.com/compute/docs/instances/managing-instance-access">OS Login</link>
+     to manage SSH access to Google Compute Engine instances, which supersedes
+     the imperative and broken <literal>google-accounts-daemon</literal> used
+     in <literal>nixos/modules/virtualisation/google-compute-config.nix</literal>.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
@@ -318,6 +327,22 @@
      case.
    </para>
   </listitem>
+  <listitem>
+   <para>
+     The <literal>pam_unix</literal> account module is now loaded with its
+     control field set to <literal>required</literal> instead of
+     <literal>sufficient</literal>, so that later pam account modules that
+     might do more extensive checks are being executed.
+     Previously, the whole account module verification was exited prematurely
+     in case a nss module provided the account name to
+     <literal>pam_unix</literal>.
+     The LDAP and SSSD NixOS modules already add their NSS modules when
+     enabled. In case your setup breaks due to some later pam account module
+     previosuly shadowed, or failing NSS lookups, please file a bug. You can
+     get back the old behaviour by manually setting
+     <literal><![CDATA[security.pam.services.<name?>.text]]></literal>.
+   </para>
+  </listitem>
   </itemizedlist>
  </section>
 

nixos/lib/testing.nix

@@ -116,7 +116,7 @@ in rec {
 
       vms = map (m: m.config.system.build.vm) (lib.attrValues nodes);
 
-      ocrProg = tesseract_4.override { enableLanguages = [ "eng" ]; };
+      ocrProg = tesseract4.override { enableLanguages = [ "eng" ]; };
 
       imagemagick_tiff = imagemagick_light.override { inherit libtiff; };
 

nixos/lib/utils.nix

@@ -7,9 +7,8 @@ rec {
                      || elem fs.mountPoint [ "/" "/nix" "/nix/store" "/var" "/var/log" "/var/lib" "/etc" ];
 
   # Check whenever `b` depends on `a` as a fileSystem
-  # FIXME: it's incorrect to simply use hasPrefix here: "/dev/a" is not a parent of "/dev/ab"
+  fsBefore = a: b: a.mountPoint == b.device
-  fsBefore = a: b: ((any (x: elem x [ "bind" "move" ]) b.options) && (a.mountPoint == b.device))
+                || hasPrefix "${a.mountPoint}${optionalString (!(hasSuffix "/" a.mountPoint)) "/"}" b.mountPoint;
-                || (hasPrefix a.mountPoint b.mountPoint);
 
   # Escape a path according to the systemd rules, e.g. /dev/xyzzy
   # becomes dev-xyzzy.  FIXME: slow.

nixos/modules/config/nsswitch.nix

@@ -1,6 +1,6 @@
 # Configuration for the Name Service Switch (/etc/nsswitch.conf).
 
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 
 with lib;
 
@@ -15,6 +15,7 @@ let
   ldap = canLoadExternalModules && (config.users.ldap.enable && config.users.ldap.nsswitch);
   sssd = canLoadExternalModules && config.services.sssd.enable;
   resolved = canLoadExternalModules && config.services.resolved.enable;
+  googleOsLogin = canLoadExternalModules && config.security.googleOsLogin.enable;
 
   hostArray = [ "files" ]
     ++ optional mymachines "mymachines"
@@ -29,6 +30,7 @@ let
     ++ optional sssd "sss"
     ++ optional ldap "ldap"
     ++ optional mymachines "mymachines"
+    ++ optional googleOsLogin "cache_oslogin oslogin"
     ++ [ "systemd" ];
 
   shadowArray = [ "files" ]
@@ -97,7 +99,7 @@ in {
     # configured IP addresses, or ::1 and 127.0.0.2 as
     # fallbacks. Systemd also provides nss-mymachines to return IP
     # addresses of local containers.
-    system.nssModules = optionals canLoadExternalModules [ config.systemd.package.out ];
+    system.nssModules = (optionals canLoadExternalModules [ config.systemd.package.out ])
-
+      ++ optional googleOsLogin pkgs.google-compute-engine-oslogin.out;
   };
 }

nixos/modules/module-list.nix

@@ -154,6 +154,7 @@
   ./security/chromium-suid-sandbox.nix
   ./security/dhparams.nix
   ./security/duosec.nix
+  ./security/google_oslogin.nix
   ./security/hidepid.nix
   ./security/lock-kernel-modules.nix
   ./security/misc.nix
@@ -303,6 +304,7 @@
   ./services/hardware/usbmuxd.nix
   ./services/hardware/thermald.nix
   ./services/hardware/undervolt.nix
+  ./services/hardware/vdr.nix
   ./services/logging/SystemdJournal2Gelf.nix
   ./services/logging/awstats.nix
   ./services/logging/fluentd.nix

nixos/modules/security/google_oslogin.nix

@@ -0,0 +1,68 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.security.googleOsLogin;
+  package = pkgs.google-compute-engine-oslogin;
+
+in
+
+{
+
+  options = {
+
+    security.googleOsLogin.enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to enable Google OS Login
+
+        The OS Login package enables the following components:
+        AuthorizedKeysCommand to query valid SSH keys from the user's OS Login
+        profile during ssh authentication phase.
+        NSS Module to provide user and group information
+        PAM Module for the sshd service, providing authorization and
+        authentication support, allowing the system to use data stored in
+        Google Cloud IAM permissions to control both, the ability to log into
+        an instance, and to perform operations as root (sudo).
+      '';
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+    security.pam.services.sshd = {
+      makeHomeDir = true;
+      googleOsLoginAccountVerification = true;
+      # disabled for now: googleOsLoginAuthentication = true;
+    };
+
+    security.sudo.extraConfig = ''
+      #includedir /run/google-sudoers.d
+    '';
+    systemd.tmpfiles.rules = [
+      "d /run/google-sudoers.d 750 root root -"
+      "d /var/google-users.d 750 root root -"
+    ];
+
+    # enable the nss module, so user lookups etc. work
+    system.nssModules = [ package ];
+
+    # Ugly: sshd refuses to start if a store path is given because /nix/store is group-writable.
+    # So indirect by a symlink.
+    environment.etc."ssh/authorized_keys_command_google_oslogin" = {
+      mode = "0755";
+      text = ''
+        #!/bin/sh
+        exec ${package}/bin/google_authorized_keys "$@"
+      '';
+    };
+    services.openssh.extraConfig = ''
+      AuthorizedKeysCommand /etc/ssh/authorized_keys_command_google_oslogin %u
+      AuthorizedKeysCommandUser nobody
+    '';
+  };
+
+}

nixos/modules/security/pam.nix

@@ -77,6 +77,30 @@ let
         '';
       };
 
+      googleOsLoginAccountVerification = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          If set, will use the Google OS Login PAM modules
+          (<literal>pam_oslogin_login</literal>,
+          <literal>pam_oslogin_admin</literal>) to verify possible OS Login
+          users and set sudoers configuration accordingly.
+          This only makes sense to enable for the <literal>sshd</literal> PAM
+          service.
+        '';
+      };
+
+      googleOsLoginAuthentication = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          If set, will use the <literal>pam_oslogin_login</literal>'s user
+          authentication methods to authenticate users using 2FA.
+          This only makes sense to enable for the <literal>sshd</literal> PAM
+          service.
+        '';
+      };
+
       fprintAuth = mkOption {
         default = config.services.fprintd.enable;
         type = types.bool;
@@ -269,7 +293,7 @@ let
       text = mkDefault
         (''
           # Account management.
-          account ${if cfg.sssdStrictAccess then "required" else "sufficient"} pam_unix.so
+          account required pam_unix.so
           ${optionalString use_ldap
               "account sufficient ${pam_ldap}/lib/security/pam_ldap.so"}
           ${optionalString (config.services.sssd.enable && cfg.sssdStrictAccess==false)
@@ -278,8 +302,14 @@ let
               "account [default=bad success=ok user_unknown=ignore] ${pkgs.sssd}/lib/security/pam_sss.so"}
           ${optionalString config.krb5.enable
               "account sufficient ${pam_krb5}/lib/security/pam_krb5.so"}
+          ${optionalString cfg.googleOsLoginAccountVerification ''
+            account [success=ok ignore=ignore default=die] ${pkgs.google-compute-engine-oslogin}/lib/pam_oslogin_login.so
+            account [success=ok default=ignore] ${pkgs.google-compute-engine-oslogin}/lib/pam_oslogin_admin.so
+          ''}
 
           # Authentication management.
+          ${optionalString cfg.googleOsLoginAuthentication
+              "auth [success=done perm_denied=bad default=ignore] ${pkgs.google-compute-engine-oslogin}/lib/pam_oslogin_login.so"}
           ${optionalString cfg.rootOK
               "auth sufficient pam_rootok.so"}
           ${optionalString cfg.requireWheel

nixos/modules/services/databases/aerospike.nix

@@ -43,6 +43,7 @@ in
 
       package = mkOption {
         default = pkgs.aerospike;
+        defaultText = "pkgs.aerospike";
         type = types.package;
         description = "Which Aerospike derivation to use";
       };

nixos/modules/services/databases/clickhouse.nix

@@ -70,6 +70,11 @@ with lib;
       };
     };
 
+    environment.systemPackages = [ pkgs.clickhouse ];
+
+    # startup requires a `/etc/localtime` which only if exists if `time.timeZone != null`
+    time.timeZone = mkDefault "UTC";
+
   };
 
 }

nixos/modules/services/hardware/vdr.nix

@@ -0,0 +1,71 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.vdr;
+  libDir = "/var/lib/vdr";
+in {
+
+  ###### interface
+
+  options = {
+
+    services.vdr = {
+      enable = mkEnableOption "enable VDR. Please put config into ${libDir}.";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.vdr;
+        defaultText = "pkgs.vdr";
+        example = literalExample "pkgs.wrapVdr.override { plugins = with pkgs.vdrPlugins; [ hello ]; }";
+        description = "Package to use.";
+      };
+
+      videoDir = mkOption {
+        type = types.path;
+        default = "/srv/vdr/video";
+        description = "Recording directory";
+      };
+
+      extraArguments = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = "Additional command line arguments to pass to VDR.";
+      };
+    };
+  };
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+    systemd.tmpfiles.rules = [
+      "d ${cfg.videoDir} 0755 vdr vdr -"
+      "Z ${cfg.videoDir} - vdr vdr -"
+    ];
+
+    systemd.services.vdr = {
+      description = "VDR";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = ''
+          ${cfg.package}/bin/vdr \
+            --video="${cfg.videoDir}" \
+            --config="${libDir}" \
+            ${escapeShellArgs cfg.extraArguments}
+        '';
+        User = "vdr";
+        CacheDirectory = "vdr";
+        StateDirectory = "vdr";
+        Restart = "on-failure";
+      };
+    };
+
+    users.users.vdr = {
+      group = "vdr";
+      home = libDir;
+    };
+
+    users.groups.vdr = {};
+  };
+}

nixos/modules/services/network-filesystems/ipfs.nix

@@ -74,7 +74,7 @@ in {
 
     services.ipfs = {
 
-      enable = mkEnableOption "Interplanetary File System";
+      enable = mkEnableOption "Interplanetary File System (WARNING: may cause severe network degredation)";
 
       user = mkOption {
         type = types.str;

nixos/modules/services/networking/shairport-sync.nix

@@ -27,7 +27,7 @@ in
       };
 
       arguments = mkOption {
-        default = "-v -d pulse";
+        default = "-v pulse";
         description = ''
           Arguments to pass to the daemon. Defaults to a local pulseaudio
           server.

nixos/modules/services/x11/display-managers/default.nix

@@ -194,9 +194,12 @@ let
         ${xorg.lndir}/bin/lndir ${pkg}/share/xsessions $out/share/xsessions
       '') cfg.displayManager.extraSessionFilePackages}
 
-      mkdir -p "$out/share/wayland-sessions"
+      
       ${concatMapStrings (pkg: ''
-        ${xorg.lndir}/bin/lndir ${pkg}/share/wayland-sessions $out/share/wayland-sessions
+        if test -d ${pkg}/share/wayland-sessions; then
+          mkdir -p "$out/share/wayland-sessions"
+          ${xorg.lndir}/bin/lndir ${pkg}/share/wayland-sessions $out/share/wayland-sessions
+        fi
       '') cfg.displayManager.extraSessionFilePackages}
     '';
 

nixos/modules/virtualisation/google-compute-config.nix

@@ -65,33 +65,7 @@ in
   # GC has 1460 MTU
   networking.interfaces.eth0.mtu = 1460;
 
-  # allow the google-accounts-daemon to manage users
+  security.googleOsLogin.enable = true;
-  users.mutableUsers = true;
-  # and allow users to sudo without password
-  security.sudo.enable = true;
-  security.sudo.extraConfig = ''
-  %google-sudoers ALL=(ALL:ALL) NOPASSWD:ALL
-  '';
-
-  # NOTE: google-accounts tries to write to /etc/sudoers.d but the folder doesn't exist
-  # FIXME: not such file or directory on dynamic SSH provisioning
-  systemd.services.google-accounts-daemon = {
-    description = "Google Compute Engine Accounts Daemon";
-    # This daemon creates dynamic users
-    enable = config.users.mutableUsers;
-    after = [
-      "network.target"
-      "google-instance-setup.service"
-      "google-network-setup.service"
-    ];
-    requires = ["network.target"];
-    wantedBy = ["multi-user.target"];
-    path = with pkgs; [ shadow ];
-    serviceConfig = {
-      Type = "simple";
-      ExecStart = "${gce}/bin/google_accounts_daemon --debug";
-    };
-  };
 
   systemd.services.google-clock-skew-daemon = {
     description = "Google Compute Engine Clock Skew Daemon";

nixos/release-combined.nix

@@ -5,7 +5,7 @@
 { nixpkgs ? { outPath = (import ../lib).cleanSource ./..; revCount = 56789; shortRev = "gfedcba"; }
 , stableBranch ? false
 , supportedSystems ? [ "x86_64-linux" ]
-, limitedSupportedSystems ? [ "i686-linux" ]
+, limitedSupportedSystems ? [ "i686-linux" "aarch64-linux" ]
 }:
 
 let
@@ -46,16 +46,20 @@ in rec {
     };
     constituents =
       let
-        all = x: map (system: x.${system}) supportedSystems;
+        # Except for the given systems, return the system-specific constituent
+        except = systems: x: map (system: x.${system}) (pkgs.lib.subtractLists systems supportedSystems);
+        all = x: except [] x;
       in [
         nixos.channel
         (all nixos.dummy)
         (all nixos.manual)
 
-        nixos.iso_minimal.x86_64-linux or []
-        nixos.iso_minimal.i686-linux or []
         nixos.iso_graphical.x86_64-linux or []
+        nixos.iso_minimal.aarch64-linux or []
+        nixos.iso_minimal.i686-linux or []
+        nixos.iso_minimal.x86_64-linux or []
         nixos.ova.x86_64-linux or []
+        nixos.sd_image.aarch64-linux or []
 
         #(all nixos.tests.containers)
         (all nixos.tests.containers-imperative)
@@ -63,24 +67,24 @@ in rec {
         nixos.tests.chromium.x86_64-linux or []
         (all nixos.tests.firefox)
         (all nixos.tests.firewall)
-        (all nixos.tests.gnome3)
+        (except ["aarch64-linux"] nixos.tests.gnome3)
         nixos.tests.installer.zfsroot.x86_64-linux or [] # ZFS is 64bit only
-        (all nixos.tests.installer.lvm)
+        (except ["aarch64-linux"] nixos.tests.installer.lvm)
-        (all nixos.tests.installer.luksroot)
+        (except ["aarch64-linux"] nixos.tests.installer.luksroot)
-        (all nixos.tests.installer.separateBoot)
+        (except ["aarch64-linux"] nixos.tests.installer.separateBoot)
-        (all nixos.tests.installer.separateBootFat)
+        (except ["aarch64-linux"] nixos.tests.installer.separateBootFat)
-        (all nixos.tests.installer.simple)
+        (except ["aarch64-linux"] nixos.tests.installer.simple)
-        (all nixos.tests.installer.simpleLabels)
+        (except ["aarch64-linux"] nixos.tests.installer.simpleLabels)
-        (all nixos.tests.installer.simpleProvided)
+        (except ["aarch64-linux"] nixos.tests.installer.simpleProvided)
-        (all nixos.tests.installer.simpleUefiSystemdBoot)
+        (except ["aarch64-linux"] nixos.tests.installer.simpleUefiSystemdBoot)
-        (all nixos.tests.installer.swraid)
+        (except ["aarch64-linux"] nixos.tests.installer.swraid)
-        (all nixos.tests.installer.btrfsSimple)
+        (except ["aarch64-linux"] nixos.tests.installer.btrfsSimple)
-        (all nixos.tests.installer.btrfsSubvols)
+        (except ["aarch64-linux"] nixos.tests.installer.btrfsSubvols)
-        (all nixos.tests.installer.btrfsSubvolDefault)
+        (except ["aarch64-linux"] nixos.tests.installer.btrfsSubvolDefault)
-        (all nixos.tests.boot.biosCdrom)
+        (except ["aarch64-linux"] nixos.tests.boot.biosCdrom)
-        #(all nixos.tests.boot.biosUsb) # disabled due to issue #15690
+        #(except ["aarch64-linux"] nixos.tests.boot.biosUsb) # disabled due to issue #15690
-        (all nixos.tests.boot.uefiCdrom)
+        (except ["aarch64-linux"] nixos.tests.boot.uefiCdrom)
-        (all nixos.tests.boot.uefiUsb)
+        (except ["aarch64-linux"] nixos.tests.boot.uefiUsb)
         (all nixos.tests.boot-stage1)
         (all nixos.tests.hibernate)
         nixos.tests.docker.x86_64-linux or []
@@ -132,7 +136,8 @@ in rec {
 
         nixpkgs.tarball
         (all allSupportedNixpkgs.emacs)
-        (all allSupportedNixpkgs.jdk)
+        # The currently available aarch64 JDK is unfree
+        (except ["aarch64-linux"] allSupportedNixpkgs.jdk)
       ];
   });
 

nixos/release.nix

@@ -157,7 +157,7 @@ in rec {
 
   # A variant with a more recent (but possibly less stable) kernel
   # that might support more hardware.
-  iso_minimal_new_kernel = forMatchingSystems [ "x86_64-linux" ] (system: makeIso {
+  iso_minimal_new_kernel = forMatchingSystems [ "x86_64-linux" "aarch64-linux" ] (system: makeIso {
     module = ./modules/installer/cd-dvd/installation-cd-minimal-new-kernel.nix;
     type = "minimal-new-kernel";
     inherit system;
@@ -273,7 +273,7 @@ in rec {
       { services.httpd.enable = true;
         services.httpd.adminAddr = "foo@example.org";
         services.postgresql.enable = true;
-        services.postgresql.package = pkgs.postgresql_9_3;
+        services.postgresql.package = pkgs.postgresql;
         environment.systemPackages = [ pkgs.php ];
       });
   };

nixos/tests/all-tests.nix

@@ -39,6 +39,7 @@ in
   cfssl = handleTestOn ["x86_64-linux"] ./cfssl.nix {};
   chromium = (handleTestOn ["x86_64-linux"] ./chromium.nix {}).stable or {};
   cjdns = handleTest ./cjdns.nix {};
+  clickhouse = handleTest ./clickhouse.nix {};
   cloud-init = handleTest ./cloud-init.nix {};
   codimd = handleTest ./codimd.nix {};
   containers-bridge = handleTest ./containers-bridge.nix {};
@@ -80,6 +81,7 @@ in
   gitlab = handleTest ./gitlab.nix {};
   gitolite = handleTest ./gitolite.nix {};
   gjs = handleTest ./gjs.nix {};
+  google-oslogin = handleTest ./google-oslogin {};
   gnome3 = handleTestOn ["x86_64-linux"] ./gnome3.nix {}; # libsmbios is unsupported on aarch64
   gnome3-gdm = handleTestOn ["x86_64-linux"] ./gnome3-gdm.nix {}; # libsmbios is unsupported on aarch64
   gocd-agent = handleTest ./gocd-agent.nix {};

nixos/tests/clickhouse.nix

@@ -0,0 +1,25 @@
+import ./make-test.nix ({ pkgs, ... }: {
+  name = "clickhouse";
+  meta.maintainers = with pkgs.stdenv.lib.maintainers; [ ma27 ];
+
+  machine = {
+    services.clickhouse.enable = true;
+  };
+
+  testScript =
+    let
+      # work around quote/substitution complexity by Nix, Perl, bash and SQL.
+      tableDDL = pkgs.writeText "ddl.sql" "CREATE TABLE `demo` (`value` FixedString(10)) engine = MergeTree PARTITION BY value ORDER BY tuple();";
+      insertQuery = pkgs.writeText "insert.sql" "INSERT INTO `demo` (`value`) VALUES ('foo');";
+      selectQuery = pkgs.writeText "select.sql" "SELECT * from `demo`";
+    in
+      ''
+        $machine->start();
+        $machine->waitForUnit("clickhouse.service");
+        $machine->waitForOpenPort(9000);
+
+        $machine->succeed("cat ${tableDDL} | clickhouse-client");
+        $machine->succeed("cat ${insertQuery} | clickhouse-client");
+        $machine->succeed("cat ${selectQuery} | clickhouse-client | grep foo");
+      '';
+})

nixos/tests/google-oslogin/default.nix

@@ -0,0 +1,52 @@
+import ../make-test.nix ({ pkgs, ... } :
+let
+  inherit (import ./../ssh-keys.nix pkgs)
+    snakeOilPrivateKey snakeOilPublicKey;
+in {
+  name = "google-oslogin";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ adisbladis flokli ];
+  };
+
+  nodes = {
+    # the server provides both the the mocked google metadata server and the ssh server
+    server = (import ./server.nix pkgs);
+
+    client = { ... }: {};
+  };
+  testScript =  ''
+    startAll;
+
+    $server->waitForUnit("mock-google-metadata.service");
+    $server->waitForOpenPort(80);
+
+    # mockserver should return a non-expired ssh key for both mockuser and mockadmin
+    $server->succeed('${pkgs.google-compute-engine-oslogin}/bin/google_authorized_keys mockuser | grep -q "${snakeOilPublicKey}"');
+    $server->succeed('${pkgs.google-compute-engine-oslogin}/bin/google_authorized_keys mockadmin | grep -q "${snakeOilPublicKey}"');
+
+    # install snakeoil ssh key on the client
+    $client->succeed("mkdir -p ~/.ssh");
+    $client->succeed("cat ${snakeOilPrivateKey} > ~/.ssh/id_snakeoil");
+    $client->succeed("chmod 600 ~/.ssh/id_snakeoil");
+
+    $client->waitForUnit("network.target");
+    $server->waitForUnit("sshd.service");
+
+    # we should not be able to connect as non-existing user
+    $client->fail("ssh -o User=ghost -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server -i ~/.ssh/id_snakeoil 'true'");
+
+    # we should be able to connect as mockuser
+    $client->succeed("ssh -o User=mockuser -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server -i ~/.ssh/id_snakeoil 'true'");
+    # but we shouldn't be able to sudo
+    $client->fail("ssh -o User=mockuser -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server -i ~/.ssh/id_snakeoil '/run/wrappers/bin/sudo /run/current-system/sw/bin/id' | grep -q 'root'");
+
+    # we should also be able to log in as mockadmin
+    $client->succeed("ssh -o User=mockadmin -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server -i ~/.ssh/id_snakeoil 'true'");
+    # pam_oslogin_admin.so should now have generated a sudoers file
+    $server->succeed("find /run/google-sudoers.d | grep -q '/run/google-sudoers.d/mockadmin'");
+
+    # and we should be able to sudo
+    $client->succeed("ssh -o User=mockadmin -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server -i ~/.ssh/id_snakeoil '/run/wrappers/bin/sudo /run/current-system/sw/bin/id' | grep -q 'root'");
+  '';
+  })
+

nixos/tests/google-oslogin/server.nix

@@ -0,0 +1,29 @@
+{ pkgs, ... }:
+let
+  inherit (import ./../ssh-keys.nix pkgs)
+    snakeOilPrivateKey snakeOilPublicKey;
+in {
+  networking.firewall.allowedTCPPorts = [ 80 ];
+
+  systemd.services.mock-google-metadata = {
+    description = "Mock Google metadata service";
+    serviceConfig.Type = "simple";
+    serviceConfig.ExecStart = "${pkgs.python3}/bin/python ${./server.py}";
+    environment = {
+      SNAKEOIL_PUBLIC_KEY = snakeOilPublicKey;
+    };
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+  };
+
+  services.openssh.enable = true;
+  services.openssh.challengeResponseAuthentication = false;
+  services.openssh.passwordAuthentication = false;
+
+  security.googleOsLogin.enable = true;
+
+  # Mock google service
+  networking.extraHosts = ''
+    127.0.0.1 metadata.google.internal
+  '';
+}

nixos/tests/google-oslogin/server.py

@@ -0,0 +1,96 @@
+#!/usr/bin/env python3
+import json
+import sys
+import time
+import os
+import hashlib
+import base64
+
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from typing import Dict
+
+SNAKEOIL_PUBLIC_KEY = os.environ['SNAKEOIL_PUBLIC_KEY']
+
+
+def w(msg):
+    sys.stderr.write(f"{msg}\n")
+    sys.stderr.flush()
+
+
+def gen_fingerprint(pubkey):
+    decoded_key = base64.b64decode(pubkey.encode("ascii").split()[1])
+    return hashlib.sha256(decoded_key).hexdigest()
+
+def gen_email(username):
+    """username seems to be a 21 characters long number string, so mimic that in a reproducible way"""
+    return str(int(hashlib.sha256(username.encode()).hexdigest(), 16))[0:21]
+
+def gen_mockuser(username: str, uid: str, gid: str, home_directory: str, snakeoil_pubkey: str) -> Dict:
+    snakeoil_pubkey_fingerprint = gen_fingerprint(snakeoil_pubkey)
+    # seems to be a 21 characters long numberstring, so mimic that in a reproducible way
+    email = gen_email(username)
+    return {
+        "loginProfiles": [
+            {
+                "name": email,
+                "posixAccounts": [
+                    {
+                        "primary": True,
+                        "username": username,
+                        "uid": uid,
+                        "gid": gid,
+                        "homeDirectory": home_directory,
+                        "operatingSystemType": "LINUX"
+                    }
+                ],
+                "sshPublicKeys": {
+                    snakeoil_pubkey_fingerprint: {
+                        "key": snakeoil_pubkey,
+                        "expirationTimeUsec": str((time.time() + 600) * 1000000),  # 10 minutes in the future
+                        "fingerprint": snakeoil_pubkey_fingerprint
+                    }
+                }
+            }
+        ]
+    }
+
+
+class ReqHandler(BaseHTTPRequestHandler):
+    def _send_json_ok(self, data):
+        self.send_response(200)
+        self.send_header('Content-type', 'application/json')
+        self.end_headers()
+        out = json.dumps(data).encode()
+        w(out)
+        self.wfile.write(out)
+
+    def do_GET(self):
+        p = str(self.path)
+        # mockuser and mockadmin are allowed to login, both use the same snakeoil public key
+        if p == '/computeMetadata/v1/oslogin/users?username=mockuser' \
+            or p == '/computeMetadata/v1/oslogin/users?uid=1009719690':
+            self._send_json_ok(gen_mockuser(username='mockuser', uid='1009719690', gid='1009719690',
+                                            home_directory='/home/mockuser', snakeoil_pubkey=SNAKEOIL_PUBLIC_KEY))
+        elif p == '/computeMetadata/v1/oslogin/users?username=mockadmin' \
+            or p == '/computeMetadata/v1/oslogin/users?uid=1009719691':
+            self._send_json_ok(gen_mockuser(username='mockadmin', uid='1009719691', gid='1009719691',
+                                            home_directory='/home/mockadmin', snakeoil_pubkey=SNAKEOIL_PUBLIC_KEY))
+
+        # mockuser is allowed to login
+        elif p == f"/computeMetadata/v1/oslogin/authorize?email={gen_email('mockuser')}&policy=login":
+            self._send_json_ok({'success': True})
+
+        # mockadmin may also become root
+        elif p == f"/computeMetadata/v1/oslogin/authorize?email={gen_email('mockadmin')}&policy=login" or p == f"/computeMetadata/v1/oslogin/authorize?email={gen_email('mockadmin')}&policy=adminLogin":
+            self._send_json_ok({'success': True})
+        else:
+            sys.stderr.write(f"Unhandled path: {p}\n")
+            sys.stderr.flush()
+            self.send_response(501)
+            self.end_headers()
+            self.wfile.write(b'')
+
+
+if __name__ == '__main__':
+    s = HTTPServer(('0.0.0.0', 80), ReqHandler)
+    s.serve_forever()

nixos/tests/home-assistant.nix

@@ -4,6 +4,7 @@ let
   configDir = "/var/lib/foobar";
   apiPassword = "some_secret";
   mqttPassword = "another_secret";
+  hassCli = "hass-cli --server http://hass:8123 --password '${apiPassword}'";
 
 in {
   name = "home-assistant";
@@ -16,7 +17,7 @@ in {
       { pkgs, ... }:
       {
         environment.systemPackages = with pkgs; [
-          mosquitto
+          mosquitto home-assistant-cli
         ];
         services.home-assistant = {
           inherit configDir;
@@ -71,6 +72,11 @@ in {
     $hass->waitUntilSucceeds("mosquitto_pub -V mqttv311 -t home-assistant/test -u homeassistant -P '${mqttPassword}' -m let_there_be_light");
     $hass->succeed("curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}' | grep -qF '\"state\": \"on\"'");
 
+    # Toggle a binary sensor using hass-cli
+    $hass->succeed("${hassCli} entity get binary_sensor.mqtt_binary_sensor | grep -qF '\"state\": \"on\"'");
+    $hass->succeed("${hassCli} entity edit binary_sensor.mqtt_binary_sensor --json='{\"state\": \"off\"}'");
+    $hass->succeed("curl http://localhost:8123/api/states/binary_sensor.mqtt_binary_sensor -H 'x-ha-access: ${apiPassword}' | grep -qF '\"state\": \"off\"'");
+
     # Print log to ease debugging
     my $log = $hass->succeed("cat ${configDir}/home-assistant.log");
     print "\n### home-assistant.log ###\n";

pkgs/applications/audio/ams-lv2/default.nix

@@ -21,5 +21,7 @@ stdenv.mkDerivation  rec {
     license = licenses.gpl3;
     maintainers = [ maintainers.goibhniu ];
     platforms = platforms.linux;
+    # Build uses `-msse` and `-mfpmath=sse`
+    badPlatforms = [ "aarch64-linux" ];
   };
 }

pkgs/applications/audio/artyFX/default.nix

@@ -20,5 +20,7 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = [ maintainers.magnetophon ];
     platforms = platforms.linux;
+    # Build uses `-msse` and `-mfpmath=sse`
+    badPlatforms = [ "aarch64-linux" ];
   };
 }

pkgs/applications/audio/lmms/default.nix

@@ -1,17 +1,17 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig, alsaLib ? null, fftwFloat, fltk13
-, fluidsynth ? null, lame ? null, libgig ? null, libjack2 ? null, libpulseaudio ? null
+, fluidsynth_1 ? null, lame ? null, libgig ? null, libjack2 ? null, libpulseaudio ? null
 , libsamplerate, libsoundio ? null, libsndfile, libvorbis ? null, portaudio ? null
 , qtbase, qtx11extras, qttools, SDL ? null }:
 
 stdenv.mkDerivation rec {
   name = "lmms-${version}";
-  version = "1.2.0-rc6";
+  version = "1.2.0-rc7";
 
   src = fetchFromGitHub {
     owner = "LMMS";
     repo = "lmms";
     rev = "v${version}";
-    sha256 = "1pqir5srfrknfd8nmbz565ymq18ffw8d8k9pbmzggaxvlcr12b25";
+    sha256 = "1hshzf2sbdfw37y9rz1ksgvn81kp2n23dp74lsaasc2n7wzjwdis";
     fetchSubmodules = true;
   };
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     alsaLib
     fftwFloat
     fltk13
-    fluidsynth
+    fluidsynth_1
     lame
     libgig
     libjack2

pkgs/applications/audio/lollypop/default.nix

@@ -5,7 +5,7 @@
 
 python3.pkgs.buildPythonApplication rec  {
   pname = "lollypop";
-  version = "0.9.611";
+  version = "0.9.906";
 
   format = "other";
   doCheck = false;
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec  {
     url = "https://gitlab.gnome.org/World/lollypop";
     rev = "refs/tags/${version}";
     fetchSubmodules = true;
-    sha256 = "1k78a26sld0xd14c9hr4qv8c7qaq1m8zqk1mzrh4pl7ysqqg9p20";
+    sha256 = "1blfq3vdzs3ji3sr1z6dn5c2f8w93zv2k7aa5xpfpfnds4zfd3q6";
   };
 
   nativeBuildInputs = with python3.pkgs; [

pkgs/applications/audio/qmmp/default.nix

@@ -29,11 +29,11 @@
 # handle that.
 
 stdenv.mkDerivation rec {
-  name = "qmmp-1.2.4";
+  name = "qmmp-1.2.5";
 
   src = fetchurl {
     url = "http://qmmp.ylsoftware.com/files/${name}.tar.bz2";
-    sha256 = "0rmfd6h0186b6n4g079d8kshdmp3k5n8w06a1l41m4p3fgq08j92";
+    sha256 = "1xs8kg65088yzdhdkymmknkp1s4adzv095f5jhjvy62s8ymyjvnx";
   };
 
   buildInputs =

pkgs/applications/audio/rosegarden/default.nix

@@ -3,12 +3,12 @@
 , liblo, liblrdf, libsamplerate, libsndfile, lirc ? null, qtbase }:
 
 stdenv.mkDerivation (rec {
-  version = "18.06";
+  version = "18.12";
   name = "rosegarden-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/rosegarden/${name}.tar.bz2";
-    sha256 = "04qc80sqb2ji42pq3mayhvqqn39hlxzymsywpbpzfpchr19chxx7";
+    sha256 = "15i9fm0vkn3wsgahaxqi1j5zs0wc0j3wdwml0x49084gk2p328vb";
   };
 
   patchPhase = ''

pkgs/applications/audio/whipper/default.nix

@@ -3,13 +3,13 @@
 
 python2.pkgs.buildPythonApplication rec {
   name = "whipper-${version}";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "whipper-team";
     repo = "whipper";
     rev = "v${version}";
-    sha256 = "17cn11c6c62pfhhp6vcslxpanb0czh2xbxq1g6wd7bpmgw38yd8v";
+    sha256 = "0ypbgc458i7yvbyvg6wg6agz5yzlwm1v6zw7fmyq9h59xsv27mpr";
   };
 
   pythonPath = with python2.pkgs; [

pkgs/applications/editors/android-studio/default.nix

@@ -13,14 +13,14 @@ let
     sha256Hash = "117skqjax1xz9plarhdnrw2rwprjpybdc7mx7wggxapyy920vv5r";
   };
   betaVersion = {
-    version = "3.3.0.18"; # "Android Studio 3.3 RC 2"
+    version = "3.3.0.19"; # "Android Studio 3.3 RC 3"
-    build = "182.5160847";
+    build = "182.5183351";
-    sha256Hash = "05rjwvcph0wx0p0hai5z6n9lnyhk3i5yvbvhr51jc8s3k3b6jyi5";
+    sha256Hash = "1rql4kxjic4qjcd8zssw2mmi55cxpzd0wp5g0kzwk5wybsfdcqhy";
   };
   latestVersion = { # canary & dev
-    version = "3.4.0.7"; # "Android Studio 3.4 Canary 8"
+    version = "3.4.0.8"; # "Android Studio 3.4 Canary 9"
-    build = "183.5173923";
+    build = "183.5186062";
-    sha256Hash = "0bf96c9db15rw1k1znz6yxhbrn9q990zy3pkq0nsirnqfpgllvpi";
+    sha256Hash = "04i7ys0qzj3039h41q4na6737gl55wpp6hiwfas2h6zwvj25a9z9";
   };
 in rec {
   # Old alias

pkgs/applications/editors/emacs-modes/elpa-generated.nix

@@ -39,10 +39,10 @@
       elpaBuild {
         pname = "ada-mode";
         ename = "ada-mode";
-        version = "5.3.2";
+        version = "6.0.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ada-mode-5.3.2.tar";
+          url = "https://elpa.gnu.org/packages/ada-mode-6.0.1.tar";
-          sha256 = "1ayp4y8q201fny2far9p2ziji968f2svr7apvfrlwnnpkk3w9lif";
+          sha256 = "12ryblyqnhqibaffibs7qq3xq9rf5d4y9dishq82pbbh9y8s17hj";
         };
         packageRequires = [ cl-lib emacs wisi ];
         meta = {
@@ -478,10 +478,10 @@
       elpaBuild {
         pname = "company";
         ename = "company";
-        version = "0.9.7";
+        version = "0.9.9";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/company-0.9.7.tar";
+          url = "https://elpa.gnu.org/packages/company-0.9.9.tar";
-          sha256 = "17p61yzbgymr46y6vbz7pfvydp5hfkqckbwficwkpz0nq8gcklhs";
+          sha256 = "1qinkz8gwgc27p3p3c9kddrrwx0jb4w0vgx7jq8fwpfj1n92m1rv";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -711,16 +711,16 @@
           license = lib.licenses.free;
         };
       }) {};
-    diff-hl = callPackage ({ cl-lib ? null, elpaBuild, fetchurl, lib }:
+    diff-hl = callPackage ({ cl-lib ? null, elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "diff-hl";
         ename = "diff-hl";
-        version = "1.8.4";
+        version = "1.8.5";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/diff-hl-1.8.4.tar";
+          url = "https://elpa.gnu.org/packages/diff-hl-1.8.5.tar";
-          sha256 = "0axhidc3cym7a2x4rpxf4745qss9s9ajyg4s9h5b4zn7v7fyp71n";
+          sha256 = "1vxc7z7c2qs0mx7l5sa4sybi5qbzv0s79flj74p1ynw8dl3qxg3d";
         };
-        packageRequires = [ cl-lib ];
+        packageRequires = [ cl-lib emacs ];
         meta = {
           homepage = "https://elpa.gnu.org/packages/diff-hl.html";
           license = lib.licenses.free;
@@ -835,10 +835,10 @@
       elpaBuild {
         pname = "ebdb";
         ename = "ebdb";
-        version = "0.6";
+        version = "0.6.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ebdb-0.6.tar";
+          url = "https://elpa.gnu.org/packages/ebdb-0.6.2.tar";
-          sha256 = "1zj8jvq5l4wlk4734i3isxi4barpivarq2f9kqzkfia7mcspxav8";
+          sha256 = "1b37962mvm80vk5sdk9kfvvxsxn83z5z6zvm20m9997ggl5dv4dz";
         };
         packageRequires = [ cl-lib emacs seq ];
         meta = {
@@ -891,16 +891,21 @@
           license = lib.licenses.free;
         };
       }) {};
-    eglot = callPackage ({ elpaBuild, emacs, fetchurl, jsonrpc, lib }:
+    eglot = callPackage ({ elpaBuild
+                         , emacs
+                         , fetchurl
+                         , flymake ? null
+                         , jsonrpc
+                         , lib }:
       elpaBuild {
         pname = "eglot";
         ename = "eglot";
-        version = "1.1";
+        version = "1.3";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/eglot-1.1.tar";
+          url = "https://elpa.gnu.org/packages/eglot-1.3.tar";
-          sha256 = "01h4wh87lrd9l50y20gjjkgg760v8ixvbcb3q8jykl29989zw62y";
+          sha256 = "0hndqabxvrq4ak5kx2xlds5pkayi2bfd1f1xk8aidzk5i70f7yry";
         };
-        packageRequires = [ emacs jsonrpc ];
+        packageRequires = [ emacs flymake jsonrpc ];
         meta = {
           homepage = "https://elpa.gnu.org/packages/eglot.html";
           license = lib.licenses.free;
@@ -915,10 +920,10 @@
       elpaBuild {
         pname = "el-search";
         ename = "el-search";
-        version = "1.7.15";
+        version = "1.8.7";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/el-search-1.7.15.tar";
+          url = "https://elpa.gnu.org/packages/el-search-1.8.7.tar";
-          sha256 = "000z8vllz53vmfblsrxjm2nc4h9lcyxw8xxqfxxyl99zhfiikjai";
+          sha256 = "0jlalcz8hppra2chmppd6b2g5dz8w6yscqylkx28pd7wy6aadx1r";
         };
         packageRequires = [ cl-print emacs stream ];
         meta = {
@@ -1032,10 +1037,10 @@
       elpaBuild {
         pname = "exwm";
         ename = "exwm";
-        version = "0.20";
+        version = "0.21";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/exwm-0.20.tar";
+          url = "https://elpa.gnu.org/packages/exwm-0.21.tar";
-          sha256 = "0nhhzbkm0mkj7sd1dy2c19cmn56gyaj9nl8kgy86h4fp63hjaz04";
+          sha256 = "07ng1pgsnc3isfsyzh2gfc7391p9il8lb5xqf1z6yqn20w7k6xzj";
         };
         packageRequires = [ xelb ];
         meta = {
@@ -1088,6 +1093,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    flymake = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "flymake";
+        ename = "flymake";
+        version = "1.0.3";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/flymake-1.0.3.el";
+          sha256 = "1algny2zhcl4vc7kp5czcqvxzpgqfjnz2rnkv26r0ylxig3s98v7";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/flymake.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     fountain-mode = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "fountain-mode";
@@ -1197,10 +1217,10 @@
       elpaBuild {
         pname = "gnorb";
         ename = "gnorb";
-        version = "1.6.0";
+        version = "1.6.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/gnorb-1.6.0.tar";
+          url = "https://elpa.gnu.org/packages/gnorb-1.6.1.tar";
-          sha256 = "0nssrnrf083mw7kllp0hkxdkklvildzmslcs1r3zf2hnl1ggfs8y";
+          sha256 = "0n4460hsmcc3l0y3nb3fysvh33cjwgv0a3mkc26xcx8v85zl7m63";
         };
         packageRequires = [ cl-lib ];
         meta = {
@@ -1232,10 +1252,10 @@
       elpaBuild {
         pname = "gnus-mock";
         ename = "gnus-mock";
-        version = "0.3.0";
+        version = "0.4.0";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/gnus-mock-0.3.0.tar";
+          url = "https://elpa.gnu.org/packages/gnus-mock-0.4.0.tar";
-          sha256 = "02z3f8njwv480fff57dbrf7nhmwbgm4apzicnzwmip5j4a6w5q0n";
+          sha256 = "058bd4f8za9bxayrd2j5b05qvk8lxxm8mmfwxb73d7k15z3z3l3s";
         };
         packageRequires = [];
         meta = {
@@ -1243,6 +1263,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    gpastel = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "gpastel";
+        ename = "gpastel";
+        version = "0.3.0";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/gpastel-0.3.0.el";
+          sha256 = "0426y55f7mbfbyjhl2bn0c2cn57jd4d8xvzri2pbqakff8ij470a";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/gpastel.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     heap = callPackage ({ elpaBuild, fetchurl, lib }:
       elpaBuild {
         pname = "heap";
@@ -1459,10 +1494,10 @@
       elpaBuild {
         pname = "jsonrpc";
         ename = "jsonrpc";
-        version = "1.0.6";
+        version = "1.0.7";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/jsonrpc-1.0.6.el";
+          url = "https://elpa.gnu.org/packages/jsonrpc-1.0.7.el";
-          sha256 = "13a19smz8cksv6fgcyxb111csvagkp07z5nl4imyp5b23asgl70p";
+          sha256 = "19z35gjphl4mlgpznfhlccgipnmbb3c1dvax48f4hw8qwksfcac1";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -1858,10 +1893,10 @@
       elpaBuild {
         pname = "nhexl-mode";
         ename = "nhexl-mode";
-        version = "1.0";
+        version = "1.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/nhexl-mode-1.0.el";
+          url = "https://elpa.gnu.org/packages/nhexl-mode-1.2.el";
-          sha256 = "1bf0jfim41m08ac4p4zxjj6qqw7f86gwiwyvfjg68n2nzbzgz1i9";
+          sha256 = "031h22p564qdvr9khs05qcba06pmsk68cr7zyc7c04hfr3y3ziaf";
         };
         packageRequires = [ cl-lib emacs ];
         meta = {
@@ -1989,6 +2024,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    org-edna = callPackage ({ elpaBuild, emacs, fetchurl, lib, org, seq }:
+      elpaBuild {
+        pname = "org-edna";
+        ename = "org-edna";
+        version = "1.0.1";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/org-edna-1.0.1.tar";
+          sha256 = "0xzyzx3pq1q6d66qcqx38pgxzn160y9yrzpy0ka8ap5xsm7ngn7m";
+        };
+        packageRequires = [ emacs org seq ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/org-edna.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     orgalist = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "orgalist";
@@ -2113,10 +2163,10 @@
       elpaBuild {
         pname = "posframe";
         ename = "posframe";
-        version = "0.3.0";
+        version = "0.4.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/posframe-0.3.0.el";
+          url = "https://elpa.gnu.org/packages/posframe-0.4.2.el";
-          sha256 = "0q74lwklr29c50qgaqly48nj7f49kgxiv70lsvhdy8cg2v082v8k";
+          sha256 = "1h8vvxvsg41vc1nnglqjs2q0k1yzfsn72skga9s76qa3zxmx6kds";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -2522,10 +2572,10 @@
       elpaBuild {
         pname = "ssh-deploy";
         ename = "ssh-deploy";
-        version = "2.0";
+        version = "3.0";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ssh-deploy-2.0.tar";
+          url = "https://elpa.gnu.org/packages/ssh-deploy-3.0.tar";
-          sha256 = "0mrgnandnqk25bx3x2a7hdw7pmjiq24w2lad7l2xqaqpwb8r6wgj";
+          sha256 = "0lv9qwm1dhcd2l2mnhjfpqsz6xx0wabjg5j5sm3425fjsaqws6m7";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -2552,10 +2602,10 @@
       elpaBuild {
         pname = "svg";
         ename = "svg";
-        version = "0.1";
+        version = "0.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/svg-0.1.el";
+          url = "https://elpa.gnu.org/packages/svg-0.2.el";
-          sha256 = "0v27casnjvjjaalmrbw494sk0zciws037cn6cmcc6rnhj30lzbv5";
+          sha256 = "14yfi27v3zdzh1chcjiq4l63iwh0vd99wv1z4w7agr33540jybc5";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -2578,6 +2628,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    system-packages = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "system-packages";
+        ename = "system-packages";
+        version = "1.0.10";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/system-packages-1.0.10.tar";
+          sha256 = "1vwf2j0fxrsqmrgc7x5nkkg0vlhwgxppc4w7kb5is6dgrssskpb5";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/system-packages.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     tNFA = callPackage ({ elpaBuild, fetchurl, lib, queue }:
       elpaBuild {
         pname = "tNFA";
@@ -2767,6 +2832,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    vcl-mode = callPackage ({ elpaBuild, fetchurl, lib }:
+      elpaBuild {
+        pname = "vcl-mode";
+        ename = "vcl-mode";
+        version = "1.1";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/vcl-mode-1.1.el";
+          sha256 = "1r70pmvr95k5f2xphvhliqvyh7al0qabm7wvkamximcssvs38q1h";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/vcl-mode.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     vdiff = callPackage ({ elpaBuild, emacs, fetchurl, hydra, lib }:
       elpaBuild {
         pname = "vdiff";
@@ -2932,16 +3012,16 @@
           license = lib.licenses.free;
         };
       }) {};
-    wisi = callPackage ({ cl-lib ? null, elpaBuild, emacs, fetchurl, lib }:
+    wisi = callPackage ({ cl-lib ? null, elpaBuild, emacs, fetchurl, lib, seq }:
       elpaBuild {
         pname = "wisi";
         ename = "wisi";
-        version = "1.1.6";
+        version = "2.0.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/wisi-1.1.6.tar";
+          url = "https://elpa.gnu.org/packages/wisi-2.0.1.tar";
-          sha256 = "0p7hm9l4gbp50rmpqna6jnc1pss2axdd6m6hk9ik4afbz0knzwnk";
+          sha256 = "1h0g6y33jrafcabgyi7j700hpv4p56v84c2mlqb334k1g9rq3709";
         };
-        packageRequires = [ cl-lib emacs ];
+        packageRequires = [ cl-lib emacs seq ];
         meta = {
           homepage = "https://elpa.gnu.org/packages/wisi.html";
           license = lib.licenses.free;
@@ -2966,10 +3046,10 @@
       elpaBuild {
         pname = "xclip";
         ename = "xclip";
-        version = "1.5";
+        version = "1.7";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/xclip-1.5.el";
+          url = "https://elpa.gnu.org/packages/xclip-1.7.el";
-          sha256 = "1fyqyi0672igjn53xlaj8hzbymkw08pk6wj58ndbrnm410g0h0i9";
+          sha256 = "0jpy3zzbyb16vqa9l6m45crzlypwvscvs76h8lci7kvp91kq954r";
         };
         packageRequires = [];
         meta = {
@@ -3044,10 +3124,10 @@
       elpaBuild {
         pname = "zones";
         ename = "zones";
-        version = "2018.11.13";
+        version = "2018.11.21";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/zones-2018.11.13.el";
+          url = "https://elpa.gnu.org/packages/zones-2018.11.21.el";
-          sha256 = "0716m9s5qjp5w3gdlx0p53qrfylw6mhdmic88qmsndmhkijsrax4";
+          sha256 = "0s68mnynjd08gyga7xdnb0zy3irsxl1jryidpcrkzg821vfrk11i";
         };
         packageRequires = [];
         meta = {

pkgs/applications/editors/emacs-modes/org-generated.nix

@@ -4,10 +4,10 @@
       elpaBuild {
         pname = "org";
         ename = "org";
-        version = "20181119";
+        version = "20181217";
         src = fetchurl {
-          url = "http://orgmode.org/elpa/org-20181119.tar";
+          url = "http://orgmode.org/elpa/org-20181217.tar";
-          sha256 = "0li6mx0kv70js3mlw7wxk1yi8kgc3nxnb87kdb7jy68xh4lsila7";
+          sha256 = "0j301z0429dnk1d3bn7524y848vp9il41sxpm9z9hs7gpzfdcw28";
         };
         packageRequires = [];
         meta = {
@@ -19,10 +19,10 @@
       elpaBuild {
         pname = "org-plus-contrib";
         ename = "org-plus-contrib";
-        version = "20181119";
+        version = "20181217";
         src = fetchurl {
-          url = "http://orgmode.org/elpa/org-plus-contrib-20181119.tar";
+          url = "http://orgmode.org/elpa/org-plus-contrib-20181217.tar";
-          sha256 = "0dz0vn2xyidifrwrd604yknyq843i31jcc8qgsi6wib29rh7zzpa";
+          sha256 = "1p7v9246zxkp68kc63550x3w7pmhx1drgj20wmddhvs0bqd3k3ap";
         };
         packageRequires = [];
         meta = {

pkgs/applications/editors/ghostwriter/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, qmake, pkgconfig, qtwebkit, hunspell }:
+{ stdenv, fetchFromGitHub, qmake, pkgconfig, qttools, qtwebkit, hunspell }:
 
 stdenv.mkDerivation rec {
   pname = "ghostwriter";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "1pqlr08z5syqcq5p282asxwzrrm7c1w94baxyb467swh8yp3fj5m";
   };
 
-  nativeBuildInputs = [ qmake pkgconfig ];
+  nativeBuildInputs = [ qmake pkgconfig qttools ];
 
   buildInputs = [ qtwebkit hunspell ];
 

pkgs/applications/editors/gnome-builder/default.nix

@@ -31,14 +31,14 @@
 , wrapGAppsHook
 }:
 let
-  version = "3.30.0";
+  version = "3.30.2";
   pname = "gnome-builder";
 in stdenv.mkDerivation {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1pshzpjy9rk6gijlm97s316aihykzxrmb07vilp17q5857passak";
+    sha256 = "05yax7iv9g831xvw9xdc01qc0l7qpmh6rfd692x8cbg76hljxdrr";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/manuskript/default.nix

@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "manuskript";
-  version = "0.3.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     repo = pname;
     owner = "olivierkes";
     rev = version;
-    sha256 = "0bqxc4a8kyi6xz1zs0dp85wxl9h4v8lzc6073bbcsn1zg4y59ys7";
+    sha256 = "0vqz02p3m9n4hk2jplnklr9s6niqdm5iykab6nblqdm4plb04c34";
   };
 
   propagatedBuildInputs = [

pkgs/applications/graphics/rawtherapee/default.nix

@@ -4,14 +4,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "5.4";
+  version = "5.5";
   name = "rawtherapee-" + version;
 
   src = fetchFromGitHub {
     owner = "Beep6581";
     repo = "RawTherapee";
     rev = version;
-    sha256 = "1h2x5biqsb4kfwsffqkyk8ky22qv2a0cjs1s445x9farcr3kwk99";
+    sha256 = "13clnx7rwkfa7wxgsim1xdx2pd7gwmmdad1m8a3fvywr20ml8xzk";
   };
 
   nativeBuildInputs = [ cmake pkgconfig wrapGAppsHook ];

pkgs/applications/graphics/tesseract/4.x.nix

@@ -1,61 +0,0 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, autoconf-archive, pkgconfig
-, leptonica, libpng, libtiff, icu, pango, opencl-headers
-
-# Supported list of languages or `null' for all available languages
-, enableLanguages ? null
-}:
-
-stdenv.mkDerivation rec {
-  name = "tesseract-${version}";
-  version = "4.0.0";
-
-  src = fetchFromGitHub {
-    owner = "tesseract-ocr";
-    repo = "tesseract";
-    rev = version;
-    sha256 = "1b5fi2vibc4kk9b30kkk4ais4bw8fbbv24bzr5709194hb81cav8";
-  };
-
-  tessdata = fetchFromGitHub {
-    owner = "tesseract-ocr";
-    repo = "tessdata";
-    rev = version;
-    sha256 = "1chw1ya5zf8aaj2ixr9x013x7vwwwjjmx6f2ag0d6i14lypygy28";
-  };
-
-  nativeBuildInputs = [ pkgconfig autoreconfHook autoconf-archive ];
-  buildInputs = [ leptonica libpng libtiff icu pango opencl-headers ];
-
-  # Copy the .traineddata files of the languages specified in enableLanguages
-  # into `$out/share/tessdata' and check afterwards if copying was successful.
-  postInstall = let
-    mkArg = lang: "-iname ${stdenv.lib.escapeShellArg "${lang}.traineddata"}";
-    mkFindArgs = stdenv.lib.concatMapStringsSep " -o " mkArg;
-    findLangArgs = if enableLanguages != null
-                   then "\\( ${mkFindArgs enableLanguages} \\)"
-                   else "-iname '*.traineddata'";
-  in ''
-    numLangs="$(find "$tessdata" -mindepth 1 -maxdepth 1 -type f \
-      ${findLangArgs} -exec cp -t "$out/share/tessdata" {} + -print | wc -l)"
-
-    ${if enableLanguages != null then ''
-      expected=${toString (builtins.length enableLanguages)}
-    '' else ''
-      expected="$(ls -1 "$tessdata/"*.traineddata | wc -l)"
-    ''}
-
-    if [ "$numLangs" -ne "$expected" ]; then
-      echo "Expected $expected languages, but $numLangs" \
-           "were copied to \`$out/share/tessdata'" >&2
-      exit 1
-    fi
-  '';
-
-  meta = {
-    description = "OCR engine";
-    homepage = https://github.com/tesseract-ocr/tesseract;
-    license = stdenv.lib.licenses.asl20;
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
-  };
-}

pkgs/applications/graphics/tesseract/default.nix

@@ -1,67 +1,18 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig
+{ callPackage, lowPrio }:
-, leptonica, libpng, libtiff, icu, pango, opencl-headers
-# Supported list of languages or `null' for all available languages
-, enableLanguages ? null
-# if you want just a specific list of languages, optionally specify a hash
-# to make tessdata a fixed output derivation.
-, enableLanguagesHash ? (if enableLanguages == null # all languages
-                         then "1h48xfzabhn0ldbx5ib67cp9607pr0zpblsy8z6fs4knn0zznfnw"
-                         else null)
-}:
 
-let tessdata = stdenv.mkDerivation ({
+let
-  name = "tessdata";
+  base3 = callPackage ./tesseract3.nix {};
-  src = fetchFromGitHub {
+  base4 = callPackage ./tesseract4.nix {};
-    owner = "tesseract-ocr";
+  languages = callPackage ./languages.nix {};
-    repo = "tessdata";
-    rev = "3cf1e2df1fe1d1da29295c9ef0983796c7958b7d";
-    # when updating don't forget to update the default value fo enableLanguagesHash
-    sha256 = "1v4b63v5nzcxr2y3635r19l7lj5smjmc9vfk0wmxlryxncb4vpg7";
-  };
-  buildCommand = ''
-    cd $src;
-    for lang in ${if enableLanguages==null then "*.traineddata" else stdenv.lib.concatMapStringsSep " " (x: x+".traineddata") enableLanguages} ; do
-      install -Dt $out/share/tessdata $src/$lang ;
-    done;
-  '';
-  preferLocalBuild = true;
-  } // (stdenv.lib.optionalAttrs (enableLanguagesHash != null) {
-  # when a hash is given, we make this a fixed output derivation.
-  outputHashMode = "recursive";
-  outputHashAlgo = "sha256";
-  outputHash = enableLanguagesHash;
-  }));
 in
-
+{
-stdenv.mkDerivation rec {
+  tesseract3 = callPackage ./wrapper.nix {
-  name = "tesseract-${version}";
+    tesseractBase = base3;
-  version = "3.05.00";
+    languages = languages.v3;
-
-  src = fetchFromGitHub {
-    owner = "tesseract-ocr";
-    repo = "tesseract";
-    rev = version;
-    sha256 = "11wrpcfl118wxsv2c3w2scznwb48c4547qml42s2bpdz079g8y30";
   };
 
-  enableParallelBuilding = true;
+  tesseract4 = lowPrio (callPackage ./wrapper.nix {
-
+    tesseractBase = base4;
-  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+    languages = languages.v4;
-  buildInputs = [ leptonica libpng libtiff icu pango opencl-headers ];
+  });
-
-  LIBLEPT_HEADERSDIR = "${leptonica}/include";
-
-  postInstall = ''
-    for i in ${tessdata}/share/tessdata/*; do
-      ln -s $i $out/share/tessdata;
-    done
-  '';
-
-  meta = {
-    description = "OCR engine";
-    homepage = https://github.com/tesseract-ocr/tesseract;
-    license = stdenv.lib.licenses.asl20;
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux ++ darwin;
-  };
 }

pkgs/applications/graphics/tesseract/fetch-language-hashes

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+# Usage:
+#   ./fetch-language-hashes <tessdataRev> [<language code>…]
+#
+#   Fetches all languages if no language codes are given.
+#
+# Example:
+#   ./fetch-language-hashes 4.0.0 eng spa
+#
+#   Output:
+#     eng = "0iy0...";
+#     spa = "15kw...";
+
+set -e
+
+(( $# >= 1 )) || exit 1
+tessdataRev=$1
+shift
+
+if (( $# > 0 )); then
+    langCodes="$@"
+else
+    repoPage=$(curl -fs https://github.com/tesseract-ocr/tessdata/tree/$tessdataRev || {
+                   >&2 echo "Invalid tessdataRev: $tessdataRev"
+                   exit 1
+               })
+    langCodes=$(echo $(echo "$repoPage" | grep -ohP "(?<=/)[^/]+?(?=\.traineddata)" | sort))
+fi
+
+for lang in $langCodes; do
+    url=https://github.com/tesseract-ocr/tessdata/raw/$tessdataRev/$lang.traineddata
+    hash=$(nix-prefetch-url $url 2>/dev/null)
+    echo "$lang = \"$hash\";"
+done

pkgs/applications/graphics/tesseract/languages.nix

@@ -0,0 +1,289 @@
+{ stdenv, lib, fetchurl, fetchFromGitHub }:
+
+rec {
+  makeLanguages = { tessdataRev, tessdata ? null, all ? null, languages ? {} }:
+    let
+      tessdataSrc = fetchFromGitHub {
+        owner = "tesseract-ocr";
+        repo = "tessdata";
+        rev = tessdataRev;
+        sha256 = tessdata;
+      };
+
+      languageFile = lang: sha256: fetchurl {
+        url = "https://github.com/tesseract-ocr/tessdata/raw/${tessdataRev}/${lang}.traineddata";
+        inherit sha256;
+      };
+    in
+      {
+        # Use a simple fixed-output derivation for all languages to increase nix eval performance
+        all = stdenv.mkDerivation {
+          name = "all";
+          buildCommand = ''
+            mkdir $out
+            cd ${tessdataSrc}
+            cp *.traineddata $out
+          '';
+          outputHashMode = "recursive";
+          outputHashAlgo = "sha256";
+          outputHash = all;
+        };
+      } // (lib.mapAttrs languageFile languages);
+
+  v3 = makeLanguages {
+    tessdataRev = "3cf1e2df1fe1d1da29295c9ef0983796c7958b7d";
+    tessdata = "1v4b63v5nzcxr2y3635r19l7lj5smjmc9vfk0wmxlryxncb4vpg7";
+    all = "0yj6h9n6h0kzzcqsn3z87vsi8pa60szp0yiayb0znd0v9my0dqhn";
+
+    # Run `./fetch-language-hashes <tessdataRev>` to generate these hashes
+    languages = {
+      afr = "15dsnzy4i9ai26ilm73gkfj4ck039raa88i6w443c4b1fnay2akf";
+      amh = "1wbcsdq3svxga3j1alk61xs72a9fhsfsyjxhp3cwxfaqfhrzg7h4";
+      ara = "0nk495gki6jbbnwcl2ybsx4nd02d6qykcjncq0d2g8pbgapqmj91";
+      asm = "0c3wq15yphq7x74s2sn3f90k6z1cf5j7ic62z0dynidrv99bddfh";
+      aze = "0pz073hxqkx1a1cshlgg5k11lj73s52sdxa7k3020drc314lhaxw";
+      aze_cyrl = "0djbfgx28ykcjsn2p0766qrmj256g7vhc7valc3ivsva8b906lxq";
+      bel = "04zqy8vik0fcakq6apfp8wjhkkhlg0yn9kmag1lk7s8fy9ax3ws2";
+      ben = "0q7812kn5xjm47hcgdcg911lhbgqr7hbvqckfxxm8qw0yjx2cy0m";
+      bod = "0rwq7539zzfs8xs0bf1535z1cwkm0yk1ni25f5gjav7nm6qpiaan";
+      bos = "1qr04dj7lx347gxpin5nfprbggmxq2mwx8kf3pcc3vb5x3pa57g4";
+      bul = "0cyyqgi3i4y9bfzwls0lwljzgd0r8ayfqb4bbvdh4qmbni9x42ya";
+      cat = "0kgw8f5pdw9lfbn6cfp5n1s0j8pj3418yx6rsbagzcf1gr36gbr9";
+      ceb = "1g1n4np4vhar7wfwx2km5k6kldb600rrl7npfbf75229rar068f1";
+      ces = "0zxkkyhpd74i6321nv86pkjb0k7p9cp6m174rbn42nl7jz6qxib0";
+      chi_sim = "0k250xr0gk9yh22yqxd0zpxdsrqfzs164kdv5n9rxx1g996yffij";
+      chi_tra = "03nxqpd546p0gwfj6pqzbdbv5zjpdddzlpa10xn4nvmks1mmckbp";
+      chr = "1k1sg3hap0kd5aa36ysvmhp7r3fynxf0f7lzz814h6p3g250zclb";
+      cym = "0d6wbf9cmrrzf66mhcckwdfy3xh2i38r0by9nk6isw9rl7bf7j07";
+      dan = "1s1yj56rpzmif3ir3qs4iab744cgpflk7y8812z2665bh61illpr";
+      dan_frak = "1bxi53ymib5g0139vfd2pflh7nl5925vqznq3sfgaqx7gdx630vi";
+      deu = "0fna7fqk1a8ivd7q2k38vx37qm3vbn183zh4z5zfqb4pgqmb8znb";
+      deu_frak = "1y4krkvarg7jxhcq49fgybg4phbn58y9c0z2bm8mnp28jkih1cnb";
+      dzo = "1fcz0imi7zxi99762pxfcm5iz2jcbqj3s742magka4ihrxnz07xm";
+      ell = "0r0f71jy4y29bg055qvvy93wchi3lh08zz0k9c8l7466b03yvq5v";
+      eng = "0vghah8kqcv0n5fnjb88w6siz156ysrc41fckw3f2y8c3sgmqlf0";
+      enm = "10y61xv3w1ypgqz5rgb22y5hh1i4zx03cwiqw21ifqvg4xdrln46";
+      epo = "1y5lh55mbcx33cm7qlf1dcah8ffycxmlcpzjzx9r6ij14fdd4964";
+      equ = "1nqrd0a9jqqh6byy8snfhad1hisrc92dcx44wsy7v4nf40j3mx1s";
+      est = "12ll8lq1hjcsq9hh93020w78r7f1rcxcwlvrjqw8j5p3k9jg5a4g";
+      eus = "034s9mp7lw1a4yvf2cmbbj2fbqbaq6xnjqh30yn0wq0c0jck96nw";
+      fas = "0m61p4byc0kzf75cdn6g18s8hcg9r8ifs34wr85lbsb65kil4ijx";
+      fin = "1wac333k0lcd5jwprzg99b10bq8sdc96b9d6275kg9imyqjwcc7q";
+      fra = "1ax7i0nw1lwkz4sbrvn4z0lcrcai77ymdpla7qk7yij6s4xb5bw6";
+      frk = "16nmr71p93724vk1x5mq4r8vxpwnm448p6dwqv8scg8asch1cidp";
+      frm = "00yz3hz7wcralq8wbx1ap4c6b37ac6vnz5bgmxmgdx0kqzibiddn";
+      gle = "1n8z8kmn5m628rlzgz5v0iw6h46aalflq5asa1wj5rygx1y2azpa";
+      glg = "0fdniayplc3iwmlmvhblarh1gm97dp8rqhhkb8b0clwfd9cj342z";
+      grc = "04r2193qcxqyab5998xn8bf7197wiccmjm7iakij8d0c7l61dnxb";
+      guj = "0dp8mlxmf0x9wb8dg0c508sdwz03icq94z8ji8jhwgdqgv8hw1al";
+      hat = "0793mmlxbb09c8103jhdvlczz647nyn4ykkgd3gwgavncmjh72v8";
+      heb = "16za9ff1i3ya6hz75l9v3v7j4039kscxxw21g3i2w5p9zn52hyag";
+      hin = "1vnn5wpc724kgib8jbx0kpnnp4al60ivqir72gnbyh6cpnflb6bf";
+      hrv = "15rqd6xiv2bdmalb5s6rxvw0yk6w9agn9fli3bvi703q6vpj2yn3";
+      hun = "19zzwdxwi3h3vdsgr271i1m87gfpdirk6b1ljw2j8qmfilp4sw56";
+      iku = "1v1yvc1194qycjgb4ihh5hpj6472nlbp66dii183514g2dh9x0db";
+      ind = "120d4b41wvsgcd1sgy2mp78i9hvi7w03a63078dz1yds0yqdwf1p";
+      isl = "003ngk8dfv6dglkq8pmi6jsglrfkc65js5ywh3vvkg7qfqf6qsxz";
+      ita = "1lxklk3zc3x3k8yfpp6ygyv7fndgs57dfasc97rh8782ds16wkjs";
+      ita_old = "188gby1y51pa1ycyc8y17d16hs5w27yl5ch7xzni98bdjkwbkl1z";
+      jav = "1fjyjznjchls5ifbnx2b9xagisgxvgj9lsf39rr9d87sbzdbbwbp";
+      jpn = "1wmayj8wh3pfwznjhalad2qzv38mhrzw2sxl71mycvzvpdy9ag1w";
+      kan = "0hak4953whw9vd9dzl0hq076kzb19kk45kmfxk03af4k6gb206vg";
+      kat = "16k0057cvvdc6snm5svhdv3cr7cw71g74yy8215njjbsi838imi3";
+      kat_old = "02gl755d38plyvzwfjqxvjgfqkbjs9rvzx33qfhm2zvmgbwrfrfh";
+      kaz = "0hc36w7zz5waycsk220v0r83sg991gd5f5r937mvz44viql80sgm";
+      khm = "1gb2nv5qdq5fz9w9xq4fj68p46b62sd1m986ra5qbnskxqizr12s";
+      kir = "1b1ing6qqi8qqfh4xpk76rp4gxp69wdjdl5m777ayx3v02d7nhh3";
+      kor = "1rldj6f8h1nn5wpx57b0ci7p0fnivnwzgaf0d3576xls26z2wcgv";
+      kur = "1cp2pfd6g662gvxi7ywkxfbfq1lwbis888bf1gg8ynzy342mx1ic";
+      lao = "03bdaxakmxpbbr9vsnbzzfksvm6js0l5i0ijwl71piqyxqjj1gxf";
+      lat = "1q7v7drnwpna9k2l79jbdlxiv1j617rqzjc9d48h3lfrma5z97sj";
+      lav = "0fxzyvw7n67rmw2irvlghkf1bii4w47200zv26p0v3a9dwvhc7sg";
+      lit = "0f00ggjjqrl94kwwjmjqwajyfprsml0br8vhn2gvn11gaxvm52hm";
+      mal = "1i83plhin3m6sq8p92vzlyng5z59gvvqypyh7rnmvdmm9rranx8a";
+      mar = "0ay7q53yl3709crvn5l9c9jx7hw6m5d3x2crmvnvczsh83ayfdik";
+      mkd = "1q1wadcr4j1dzssyyqz43qmizc6vfqkbivr6xi2p7p4h9rl11x73";
+      mlt = "1qp4v6habak1l7xrw322wglvjjndrfp4j7bj8d4npwbzk1sh4s0h";
+      msa = "048p6mkx9zr40s9s5vbi0gnizhvqwn0g8i1hf1l8db7igbax5xyj";
+      mya = "17nyr5bd42kzvid3421n3mwckd49vzrjhjahd8rnfsmbsy1x382l";
+      nep = "154375r32sdmvcnp1ckvgbp3wxvb2xiiypb8bxbsvrabrz4wzjqc";
+      nld = "1clwbky71zkz55zd3f8r9hj8fhpnbkply80p1js4fvs7x12r715x";
+      nor = "1ynvrz6s0vmlq1xkjd8k2w6bx8770x6v29qgx83d4nl17ngjd459";
+      ori = "0dsakc8gnwhs6z5kxc2wdkbn31gkkiqk5vriw0swghychp164aac";
+      osd = "1zq0dfliavglmix7zzrqdxz1w01rm1f1x1352bqn8xf4zivdbxcw";
+      pan = "1fwdpwkydfmr6drwgkqzn89z12r2rdm02a75vvdxhxg2a9yiwmbv";
+      pol = "155z870ygzws476kp7qpzi8jcjcv3jb5px8rbzhnag1fklqr48hx";
+      por = "1814cff2rffpzlg4hyyrjzpf5ps2i95rmpa4c8ikblbvrlcv97q8";
+      pus = "1iz5nn1zfvn1l9gb1jriwx991d2hwwc7x4k1nvzjlwpzscplx25b";
+      ron = "11lr80zhvnnngvwwk01z1d3prfpbh3qbwpl1nl5fp7h09d6n3wzl";
+      rus = "1d6a8lg4bmd3np16jds1py3qpkaq4ahnhwghd5r0159y0jpxq00q";
+      san = "169f4ajgwn99yfdfrlwfvdgvv1abal7fpdp31sknvq8l7w2sak3g";
+      sin = "1411g18r6f6j6f4n0sn7ajgs4gkplb892s6ak0hi9nyyxwv3r1gm";
+      slk = "0bxfbrg1nf6px0xzkh6ihdi71fmr1rxxs99qb191k7pm16x2lpds";
+      slk_frak = "0zyqnn1y5cyx1y7wzgw743k4584ljl0rhvk2q1ni6jnjx9ciwzqy";
+      slv = "1kjn9m9hbwp0m0p2v8c3skpzr6f8x42hz8x48zl22550a7hq8n1h";
+      spa = "1npgl8ylvfm60hd4214z8a3lriy1hckhijschrbjpzmwdfcqafgj";
+      spa_old = "0w4ivkv8flyn7bjlyjcrcrdnslkvrrfs7l33mvird1jhhkyqd8sx";
+      sqi = "15wzvh6qm3yx7yf0k5j7g1imsaqxvq7r2xh6a0xgmkqbyypbbkdf";
+      srp = "05blqriv30x02c80ds3x7zhw0y21nc6lkqlv5jwgwnjgw4yfpgrm";
+      srp_latn = "0ss8s3q60aq8sd2a3sbnzvp13qqarxnjw4hij8hd9ab5gsjw0nwr";
+      swa = "1pwwhx7ldq21cv06cchws8gvwsmkwn5sjcy9z3nk3nbp9qjsf44f";
+      swe = "0l10iyn2cr7ibgk0akmpg8725mpwpydawgv3s77izsw7y6xhfr1a";
+      syr = "08bxil13wyp5h4hvbxjcys7ypgqgg46rrp653m7gyv5q94ycjgb0";
+      tam = "1g155kyba2wjfgzgy48g6yd2csinwbfjdi5r7vw0wm3dh1z39dvz";
+      tel = "0fydrcb54b6mmqazb337x4s36i2a64sb4xm7y7g3nqqmk9afsipv";
+      tgk = "0f6j37friywj7y132fv0jm6aj4sx8f0b7brspj3pbjqqpi4v5ws0";
+      tgl = "0f1r0gicif57qhyw8xaa1sqgny720q3z5cpd5srrn9i6fihaz577";
+      tha = "1y2hw55jfpidk95y8qbsiczgg2r2khabac97s1y3gl0v93a44jna";
+      tir = "1y7iryhjr83ca4yh5jjz7qlnrx4kbrp0a0p650whjvk2gnv8m98h";
+      tur = "0xqnq99b2jb4v74bj95py6wmg14dm31zp5s3l48dmcv6zdgcxg2w";
+      uig = "1sdddr15zlb33kd1d7hzi5lfd15bfhqn105d7x6snfpqp7vq4bxv";
+      ukr = "0cdwjnfnnmzz7jdn49l96vqgaimclfxcxaw09cm63f5my382r2rg";
+      urd = "10xcn1zs2lfswp5yai0ckyg7js587qhr5cf7qib3i35qjbw7nc18";
+      uzb = "1jkkd5j6vsx5jv5gwprbfwg1vwh714prm8j446wzvp74brmk949l";
+      uzb_cyrl = "1kdia38rgm2qd3ly80a412jyagxxryr09h1nz2d0iw71bmfn4855";
+      vie = "1ja18jxxaw282y4jljxpjf1gj15il61vc2ykpfy22vn88wvydxff";
+      yid = "1jddd0g8mm5v00z5kb8rbpfs7ppzgq9kzm1xlhhvv960yfdbi6fd";
+    };
+  };
+
+  v4 = makeLanguages {
+    tessdataRev = "4.0.0";
+    tessdata = "1chw1ya5zf8aaj2ixr9x013x7vwwwjjmx6f2ag0d6i14lypygy28";
+    all = "0dqgkp369rcvq72yhgnzj1pj8yrv7kqzc7y6sqs7nzcq7l5qazlg";
+
+    # Run `./fetch-language-hashes <tessdataRev>` to generate these hashes
+    languages = {
+      afr = "1a9f8pnrspfmcq9gpjnxn2kkhjlsmh912bnpx671fjizxpmiri2y";
+      amh = "0m1vdyxjx57kmf2qra0p31k509y1cqn4pyckzw00i5n3wx11d2j0";
+      ara = "0nswl6n0s94g900j5k1gwzp7m140c0yd9a2fdb2lzhdvg1krf190";
+      asm = "025d9vrjcrwyd6cc6hrw1x8xqhicgrb9wpvhhmlw71ql04dadslf";
+      aze = "01shcs78a6xn3my8p3y42x1c9f5hzfn83w2n2nwpffbgz4y2nsgf";
+      aze_cyrl = "1sbd89i5r7rnkjh2in8j0plrxnfiill9jl8pr68iw77ghih6q1vg";
+      bel = "0dhyymsxcyzwal8474q7ag3m2akv0b92hkdz7rka5z1cxry1cn8c";
+      ben = "0a7q9414k3frn37x2qcglz722ysg2iivj6kqaaa0ik7z14ibc8v0";
+      bod = "0rh7x54nlh6ir6ldccj8hi7g8hwlp13r3fkljw8gndvhwmgfkkar";
+      bos = "1szym4n605hlx12a9vpz4jjs76jscajh22rgkqwbv4qdsl0gi3nd";
+      bre = "070f4c84iznblsw4jkwpzh9dss8nfb678160szm5r8dlv2yinrrk";
+      bul = "03bg2yw79lg8rl43y9288313jrfh0h69vl4s4cmlgbmnbx8pvxwj";
+      cat = "19xs691aj8yy2ff07c3gzm07zicd5ha0gmcjxjh9pknqf2gfy7qv";
+      ceb = "1896vn41hqc4anm6hjvrnn022i0p8pmhwsp5rv9w2cvr6738l79r";
+      ces = "0fh2g47msfr91285rnccxcmcshihm126sqy496s4vrr0vk8ix1nf";
+      chi_sim = "0qxkvbpm5l7gzsshnn72wfx473pprf5nmw8hd4i4x2qxnfddh1gw";
+      chi_sim_vert = "1f75pzvxbda82vxa2zb1z9b9f13sh81kzaw45vg5118ncsklj8w7";
+      chi_tra = "056vjws1fir1v5iv44pzykkxs5q1dbb2j8blhj47i53w1zf6g42m";
+      chi_tra_vert = "10c9cdycg1a5kwlgg60sh8yp07w2fl4whinpxfhlzrzs56allql4";
+      chr = "19qq8a6c27973djsc4xpcklis92r58x21fg4mz5azdyka5i1n46l";
+      cos = "0z9kx1hw8h5n00pcahxla808wya50wrkk8cz7x676pd93ibyrlyx";
+      cym = "13pk9cpf43xxqbz3blfz2av2yd1ma6ds6jbdiqw8anhhj7l9ch2d";
+      dan = "1jirmahxvyyswhhyzhinvcqaycz7m3ixchqrj3lgfcdi3anvabr2";
+      dan_frak = "17wcgdqxmbzn7qchnx5gsa05aj4wmhbwk43w173bl3wr6h5ylmh0";
+      deu = "194rqsg4nlycca9bg2fqf15xgcl110rxp182l7dbjfjhar4knsw9";
+      deu_frak = "12hhhp32f15c7fw2jp05mwim9ps14kmamhh6vmalvm7r2033vbm7";
+      div = "09mm9r5hxhsc4qpyg10ym9mc2kdpawx8zk0aiv1xpgd35rzpyz41";
+      dzo = "1zk7crgcazgqy5zmslp6iw4jws07nja31qdxx0rpzhn3c0bjgw1b";
+      ell = "1hhym18a9411953j47xjk47jx9ij9xi2qwlx05c93zl41528nsqg";
+      eng = "0iy07z182lwhqfa0q288ha691scpsry330aynaizn68wcmywk86s";
+      enm = "1dhr1qvil38bil43wk5ci645sbm3my2y9y7qlcbnwz2p4pflayvm";
+      epo = "1jig4db7050vww32vxsqyig3j1b0vgz9ipxbsw0jpkjia84k44n9";
+      equ = "02qwg6s1z7pynwm0p6dvpwi04ivfkr1s7qgssbla1dx7v0ih6rlg";
+      est = "1jxygahy6by7fbirbmjmd68k6560q1a3h5mvpzdx15h5fw0q58gl";
+      eus = "0cai7nm7si8680avrrls8bf9ski980rvsj560fh9y6n9rz7mh9mp";
+      fao = "1n3434jf18bzakbylzyg3jaw2ad4h376g56dsql32bgh2yvyww8a";
+      fas = "17wjkfka9725rz32clgqgk9msmbz4axs59vz30jmhhxyrkliafqb";
+      fil = "0p713k8g27df9z384ns111xqxii5kq20m8brflsmd3yckw1mibhz";
+      fin = "1wc3y9nnm7rb2c2c5fkj7cv7jb27jlkb2bh0g8kaz57h6imfmb2g";
+      fra = "04qrfvi6irlaahh1pgn5azyfhbhavm12yyybza8603alf8firh7a";
+      frk = "05cqmxxxjqdl5hjyzi6dpmixnjpd6f3jr6741yapdmnxvkzxkiyp";
+      frm = "0a86yy6hd0lvlbzvnzjmyapzc0rn7mnkdadqycd65bw1b714cvy2";
+      fry = "0i84r8g9hlkr9nlhypl4lq6ncrhbcpskqkdcijgk88c2fdknh57h";
+      gla = "17idyhb505waz9dnb8dsk54faw7y0xvvb12yw71k0skq3i90akar";
+      gle = "1q87h5zzcva54pg364d3hl6q9hdlydlyj1qmq8n5k7hqk11msxmk";
+      glg = "01xssz1rhpy3a0sm4i43nba61wc2srz6wv327vdw1kg8ijm0s0g4";
+      grc = "00x0s3smx4wg5h12y2b9al0j2jk1y3f0yy2x6f2qf7ps831drgyl";
+      guj = "028v4fgn0zi2044vk6j2rlqklc9i0kj22s52vhifmx1g02kz9154";
+      hat = "1bca516pr2cnyjlwycc7pr6gfmdjb8565hp06pw9nwpr20ry0hss";
+      heb = "1qfkffjh29b21frs0mv6llsrchixl5kjkpj1if7fq816g9mym9kx";
+      hin = "1rkfam5c6qil2590lfffzndhq3bncdgf4ij0cyjcglgyljgx0xnc";
+      hrv = "0da7b6mk0rwc9zlbqkycwjpddp3qpy07l643i00ia5a1zq35fmgp";
+      hun = "0w2s4mn9p74zqzmp9hh2017zgsh5v43k4lid4pv29f4b0y5gj9xi";
+      hye = "0ifzm875wlbjh4vkpmj1n6f14m8i174413l6pc6i44y4p5fpgxrf";
+      iku = "19arnv82xbxhbcy8pf9fv1sl5zc5707mk34nh7w46dlz86qkidmn";
+      ind = "1d421hizwni4m6sr4f3nqqpr1g744hzn0krk130m7x8mhzgamba5";
+      isl = "1hjjw8k2r9qa990ziq5wxr36kyf16mnmrqfmq5vbcjprka9h08pq";
+      ita = "1qyrvlf7pjxzyb29sc7aq3gq61bww14sijka44scxggfw7134l3r";
+      ita_old = "1pf8461jbj0vpyry0b54crmkf2bk9mh4klxvmj09jvf0aq2vm9s6";
+      jav = "18vvbyimj0y462amjmwvqa6h9n8l122j9v0w3hfp63hlxpfprm0m";
+      jpn = "16hma9w32vdh41ihymp894jza72b0d235hwriv18r78j5n86nhbg";
+      jpn_vert = "0yca09l9sbpfjgb2slnpb9q7qd7vz3a1wb6bkln30d3nl0d9r1rn";
+      kan = "0lcmx37rjfxkbhhbrld1ndmkwkm9w9b3pzxhas0cv5dqsx2f84jd";
+      kat = "1b164bgwa7bbvw4177h8fxfh0fbh4bycfl9pkaa184dpjpaiqpia";
+      kat_old = "1mgff7sh93hdp3wh0ckikdggrdgf0syp75s39pickpbkp9ic41ai";
+      kaz = "0h37y0kb5lwsp5zpl7bvxg3ryqldl5hxfnardliwgyqgnag951vi";
+      khm = "0m7x1fynr18sid2kjjw8xa9ika0a0fc6a6hvc7ihizi47893hdfb";
+      kir = "09kxwqpqf6kxjii07qlqsiii83zk12rszp88xnzzjp8rjsnk78s3";
+      kor = "0nsr43fwrp9876ia1fc0zcviv2n8hw16n0wfh158vhygwglvy84m";
+      kor_vert = "1wmvdznmikk9fq7wdffvn22scxmcl26vjh26jhicqwxpc7kg4bh8";
+      kur = "0gbsf3ny3n5mgb30v54bz3crgnimdpg19jn633pbpzryzg3xhd25";
+      kur_ara = "1sbj0cczhi9q119fbzpi0m6zr9kjp3k76bv9w8szkv1wc5y4fng6";
+      lao = "1gvxlg8bw3a4c9izg3c2a2yl7q6rsy7z9y64axdw9a04pz2ndbl5";
+      lat = "0b7an3q3xrf9c55bhiqqh7l45ga88l0kwvkp1akmlr98piach3vr";
+      lav = "0fqsmy47cygamddxyjfrdgkfa9bvmrvf4csvppnkdvfzy6iiv0c2";
+      lit = "0wjgbkwc3bf5khdqali7ylnhhs4xvpx19m3zx2y9s27v2wjbb6kv";
+      ltz = "02zdxbniiqfl87fzsiaaqgldqfsv15z5hja1xhxnqpl0nds7shfc";
+      mal = "0a41ifz8i6lj2ywxjkwvymxzxahkz2cjv4apbrawdj1h42bn7frd";
+      mar = "00swhlh9bckvmlxanfmlw5j4n9qqhggl84bsq0827bmijsqwnl44";
+      mkd = "1bqfiwxlzfpz4fs4z5ci2wbv01qhrcayk1inmk3dxq7dsywx1ajg";
+      mlt = "1rmmga2aw88hr7q7cfr5cvhnsgnf1mi069d5k7z66zp4vzbl4zyz";
+      mon = "1jksvcavn9plsmjdmhg40mwq5rlvrd1b9gvghdjg7zkf6qqqynlh";
+      mri = "0jlfawx20s5clsnk82ndy3v2zidh4cfh4acrh8nindk21xmiwh5i";
+      msa = "0m7zs8anaa3l4z5f3xvbhs4syp41dp4all2yfpi1plyr0hy784an";
+      mya = "0hljm5haadlr4k5rhw4mvhkygcnrr709rvl7amz7av3nskmi8mb1";
+      nep = "1dhy0m2h6xfgwibf92iwxsn926dmrhfvkg9rafkdaqcr4pq6w563";
+      nld = "0bspf5bv1s7qzm6k4aqbpq91zvk4kxxhx5zv08w91xfsa1zpdxmi";
+      nor = "08majhc9m0fjvac50yq52ia2af9kscclimwkv403klnj4kgf8ndq";
+      oci = "1mzrw9gsdjrd1xj3zv7l5gzgjq5jrygxf8cfkz20d9lls0wj1xdv";
+      ori = "1sh42mjzb1hv6l6lljp3wifjmz7wrv818f9f16m8qjikwqxm0s78";
+      osd = "03mvfk1q1xp1klpf4bwna903rnp51bkqr3gl5hvxybvrc3l2m7z1";
+      pan = "0165kr94p6x5yxzs4p8sfppvg9cywp65ps0xaym5rqz9iashz32h";
+      pol = "0g0b71ms6ddgykmkna4mlavgzgmh9vj6s62fi8l4ja93nfpr37hp";
+      por = "132jbhzmcsq8skanm15bw2niyx9xpbrqr411wn7w9r5i3cvnlv01";
+      pus = "0iiglnkn478al11avigsav625pn7ifscycnxpj6fg8835vjww3xr";
+      que = "01vkmfi9idjwskv5pllmrxpil0v5h7f7rzv5viclxrzkmbvrz9b5";
+      ron = "0ag6vs0cn3sryavs1mfrallgdgi4h28114g7m61rhlhq0z484g0m";
+      rus = "1hippm3w5d73sh50r136x0xff2p6x128ry2x4fywf6xdpv1f46v8";
+      san = "1qlpqkr5c5wqcf1bvlipy72advqnvd4wm61vghmrj2sda8mx87sx";
+      sin = "097d2s4ma0zsq0ab5qs1ylgl9l5phw91fnpsvb7vjmz2mw3ic964";
+      slk = "0c97pp5iffhdzyma605x8q3rx1qq9pq2h6cai1kppaj92rz3ji9k";
+      slk_frak = "16ivsam1g18zlpw6pgidvzwb7h8rvw1s10nigs6yfwir8hjxsgki";
+      slv = "0644jlm55p0dg4zchgrashmbv36zb4x649ckmf2jkbss8bzx7wsf";
+      snd = "1i2mfi4414l3v9nznjy7959y2jcr8ymvf6w8zpyrw6nad4d1aak7";
+      spa = "15kwvr7cpcnlxm1ja1yyc022dmsd04gmk7h1p0df12aicsscn3qb";
+      spa_old = "1jq80c4mi3rmwnfhb3mbaaq0ci101mgbibkji9ala4l5dkcwjra3";
+      sqi = "19cvvixhz9906p4c9i2grpr386rbp5alp4fp14xm9nd81bmq4701";
+      srp = "1jd25n13h6vxsa3gzbj6q6mdh02rjl4qrd1bffr5psp33asqvw0l";
+      srp_latn = "1k7577mn3z0bm5ma9d8l14sn5wpvw50hq1nxwbc36yn3a5b3mhiz";
+      sun = "0lvlaw3jfvr7b5v09669kq8mm19jdsk9g5h09jsa2gr6fvsq11pa";
+      swa = "0qy9qc5pa1dzzqrh1z40gk845z1r4d2smywnzydknbb3n240lhz0";
+      swe = "1y56r7bgzw0pqkdylbah07r1f0v03sblkggiql8x5200rhaxvqi4";
+      syr = "1vfj5fsiv170jghryrxwyz0i9mdsaki1kglxrklkb2caal9kwy38";
+      tam = "0rhhdbnp0a2hpg00vpc0xyxcl2w36i1kn63mrvwx1f9q7m3y1fmf";
+      tat = "0a74rp8pyp4yivv2xcy2m8xgwch8scr3wmk1fzniwzf43fsrqp76";
+      tel = "0gcq8hxhxvilyh7x7kiikq07hllqysc8sfyr88gvpj4xi092h2bx";
+      tgk = "1458gk0k6gk49n8lr6fj7l7cwkhxn0lrhybzq10zl1ly7yzjhf67";
+      tgl = "12yscwckdy3l21mvsrj1021gxw2isjrg369r08rsf7lh96wn4wkn";
+      tha = "01f0j7gsc5slxaaql1gqbhk4wlwaxc29dlmfxwjzikxc46gjl0w8";
+      tir = "1q6w48b1jchv55713pq20inzjjdymh32fw8wxfaj1qi7bjqfb9fk";
+      ton = "06g60ga8rys8jaimqrvd4svh40qs1nz4bszdnf2hdv05ibryibdq";
+      tur = "0g9g1wvibp61qbriy8ys948yfkl88xk9g8f93bnq8w8dx029b6s8";
+      uig = "09sajx21lw3a3ph62dyqr10pjaq2mij10sdhkhvvjiydk34dn548";
+      ukr = "14q8ls8gkrg7c9pc6qzm6yf5ady3i3303vs1hz4d2idcl6yry334";
+      urd = "15vszhqraxqdcng1069p6i4xq3ck3904q207nkbap6dfpcpjig40";
+      uzb = "03hyw0vavmjirqs4wkd5r85g91w2avsyl14z624fhm3gc66pqg7n";
+      uzb_cyrl = "1433lrrp2lfgb1k0a4sc20b35b2jcl8f1z92vm2936y7w04xpaq7";
+      vie = "02k40d3wji74d1jgvkr3zrn9gpzlmp0lqhrrdmc48r2sgvnrnk8n";
+      yid = "0xnbvi04xv1qapqg72wa3bjwbw51pkdnyncjpjp37vn6dzh04l0z";
+      yor = "07w3aci52ng6i6nyp97q5zb2dqlj08w6im90y1h691qah1x44zlv";
+    };
+  };
+}

pkgs/applications/graphics/tesseract/tesseract3.nix

@@ -0,0 +1,29 @@
+{ stdenv, fetchurl, fetchFromGitHub, autoreconfHook, pkgconfig
+, leptonica, libpng, libtiff, icu, pango, opencl-headers }:
+
+stdenv.mkDerivation rec {
+  name = "tesseract-${version}";
+  version = "3.05.00";
+
+  src = fetchFromGitHub {
+    owner = "tesseract-ocr";
+    repo = "tesseract";
+    rev = version;
+    sha256 = "11wrpcfl118wxsv2c3w2scznwb48c4547qml42s2bpdz079g8y30";
+  };
+
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  buildInputs = [ leptonica libpng libtiff icu pango opencl-headers ];
+
+  LIBLEPT_HEADERSDIR = "${leptonica}/include";
+
+  meta = {
+    description = "OCR engine";
+    homepage = https://github.com/tesseract-ocr/tesseract;
+    license = stdenv.lib.licenses.asl20;
+    maintainers = with stdenv.lib.maintainers; [ viric earvstedt ];
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
+  };
+}

pkgs/applications/graphics/tesseract/tesseract4.nix

@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, autoconf-archive, pkgconfig
+, leptonica, libpng, libtiff, icu, pango, opencl-headers }:
+
+stdenv.mkDerivation rec {
+  name = "tesseract-${version}";
+  version = "4.0.0";
+
+  src = fetchFromGitHub {
+    owner = "tesseract-ocr";
+    repo = "tesseract";
+    rev = version;
+    sha256 = "1b5fi2vibc4kk9b30kkk4ais4bw8fbbv24bzr5709194hb81cav8";
+  };
+
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook autoconf-archive ];
+  buildInputs = [ leptonica libpng libtiff icu pango opencl-headers ];
+
+  meta = {
+    description = "OCR engine";
+    homepage = https://github.com/tesseract-ocr/tesseract;
+    license = stdenv.lib.licenses.asl20;
+    maintainers = with stdenv.lib.maintainers; [ viric earvstedt ];
+    platforms = with stdenv.lib.platforms; linux ++ darwin;
+  };
+}

pkgs/applications/graphics/tesseract/wrapper.nix

@@ -0,0 +1,58 @@
+{ stdenv, makeWrapper, tesseractBase, languages
+
+# A list of languages like [ "eng" "spa" … ] or `null` for all available languages
+, enableLanguages ? null
+
+# A list of files or a directory containing files
+, tessdata ? (if enableLanguages == null then languages.all
+              else map (lang: languages.${lang}) enableLanguages)
+
+# This argument is obsolete
+, enableLanguagesHash ? null
+}:
+
+let
+  passthru = { inherit tesseractBase languages tessdata; };
+
+  tesseractWithData = tesseractBase.overrideAttrs (_: {
+    inherit tesseractBase tessdata;
+
+    buildInputs = [ makeWrapper ];
+
+    buildCommand = ''
+      makeWrapper {$tesseractBase,$out}/bin/tesseract --set-default TESSDATA_PREFIX $out/share/tessdata
+
+      # Recursively link include, share
+      cp -rs --no-preserve=mode $tesseractBase/{include,share} $out
+
+      cp -r --no-preserve=mode $tesseractBase/lib $out
+      # Fixup the store paths in lib so that the tessdata from this derivation is used.
+      if (( ''${#tesseractBase} != ''${#out} )); then
+        echo "Can't replace store paths due to differing lengths"
+        exit 1
+      fi
+      find $out/lib -type f -exec sed -i "s|$tesseractBase|$out|g" {} \;
+
+      if [[ -d "$tessdata" ]]; then
+        ln -s $tessdata/* $out/share/tessdata
+      else
+        for lang in $tessdata; do
+          ln -s $lang $out/share/tessdata/''${lang#/nix/store*-}
+        done
+      fi
+
+      if [[ ! -e $out/share/tessdata/eng.traineddata ]]; then
+         # This is a bug in Tesseract's internal tessdata discovery mechanism
+         echo "eng.traineddata must be present in tessdata for Tesseract to work"
+         exit 1
+      fi
+    '';
+  });
+
+  tesseract = (if enableLanguages == [] then tesseractBase else tesseractWithData) // passthru;
+in
+  if enableLanguagesHash == null then
+    tesseract
+  else
+    stdenv.lib.warn "Argument `enableLanguagesHash` is obsolete and can be removed."
+    tesseract

pkgs/applications/misc/albert/default.nix

@@ -1,24 +1,22 @@
 { mkDerivation, lib, fetchFromGitHub, makeWrapper, qtbase,
-  qtdeclarative, qtsvg, qtx11extras, muparser, cmake, python3 }:
+  qtdeclarative, qtsvg, qtx11extras, muparser, cmake, python3,
+  qtcharts }:
 
-let
-  pname = "albert";
-  version = "0.14.22";
-in
 mkDerivation rec {
-  name = "${pname}-${version}";
+  pname = "albert";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner  = "albertlauncher";
     repo   = "albert";
     rev    = "v${version}";
-    sha256 = "0i9kss5szirmd0pzw3cm692kl9rhkan1zfywfqrjdf3i3b6914sg";
+    sha256 = "063z9yq6bsxcsqsw1n93ks5dzhzv6i252mjz1d5mxhxvgmqlfk0v";
     fetchSubmodules = true;
   };
 
   nativeBuildInputs = [ cmake makeWrapper ];
 
-  buildInputs = [ qtbase qtdeclarative qtsvg qtx11extras muparser python3 ];
+  buildInputs = [ qtbase qtdeclarative qtsvg qtx11extras muparser python3 qtcharts ];
 
   enableParallelBuilding = true;
 

pkgs/applications/misc/flrig/default.nix

@@ -6,13 +6,13 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.3.40";
+  version = "1.3.41";
   pname = "flrig";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/fldigi/${name}.tar.gz";
-    sha256 = "1wr7bb2577gha7y3a8m5w60m4xdv8m0199cj2c6349sgbds373w9";
+    sha256 = "0vh14azg3pppyg3fb7kf6q3ighw1ka9m60jf2dzsd77f4hidhqx4";
   };
 
   buildInputs = [

pkgs/applications/misc/glom/default.nix

@@ -0,0 +1,132 @@
+{ stdenv
+, fetchFromGitLab
+, pkgconfig
+, autoconf
+, automake
+, libtool
+, mm-common
+, intltool
+, itstool
+, doxygen
+, graphviz
+, makeFontsConf
+, freefont_ttf
+, boost
+, libxmlxx3
+, libxslt
+, libgdamm
+, libarchive
+, libepc
+, python3
+, ncurses
+, glibmm
+, gtk3
+, openssl
+, gtkmm3
+, goocanvasmm2
+, evince
+, isocodes
+, gtksourceviewmm4
+, postgresql
+, gnome3
+, gobject-introspection
+, wrapGAppsHook
+}:
+
+let
+  gda = libgdamm.override {
+    mysqlSupport = true;
+    postgresSupport = true;
+  };
+  python = python3.withPackages (pkgs: with pkgs; [ pygobject3 ]);
+  sphinx-build = python3.pkgs.sphinx.overrideAttrs (super: {
+    postFixup = super.postFixup or "" + ''
+      # Do not propagate Python
+      rm $out/nix-support/propagated-build-inputs
+    '';
+  });
+  boost_python = boost.override { enablePython = true; inherit python; };
+in stdenv.mkDerivation rec {
+  pname = "glom";
+  version = "unstable-2018-12-16";
+
+  outputs = [ "out" "lib" "dev" "doc" "devdoc" ];
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = pname;
+    rev = "fa5ff04f209f35bf3e97bc1c3eb1d1138d6172ce";
+    sha256 = "145hnk96xa4v35i3a3mbf3fnx4nlk8cksc0qhm7nrh8cnnrbdfgn";
+  };
+
+  nativeBuildInputs = [
+    pkgconfig
+    autoconf
+    automake
+    libtool
+    mm-common
+    intltool
+    gnome3.yelp-tools
+    itstool
+    doxygen
+    graphviz
+    sphinx-build
+    wrapGAppsHook
+    gobject-introspection # for setup hook
+  ];
+
+  buildInputs = [
+    boost_python
+    glibmm
+    gtk3
+    openssl
+    libxmlxx3
+    libxslt
+    gda
+    libarchive
+    libepc
+    python
+    ncurses # for python
+    gtkmm3
+    goocanvasmm2
+    evince
+    isocodes
+    python3.pkgs.pygobject3
+    gtksourceviewmm4
+    postgresql # for pg_config
+  ];
+
+  enableParallelBuilding = true;
+
+  preConfigure = "NOCONFIGURE=1 ./autogen.sh";
+
+  configureFlags = [
+    "--with-boost-python=boost_python${stdenv.lib.versions.major python3.version}${stdenv.lib.versions.minor python3.version}"
+  ];
+
+  makeFlags = [
+    "libdocdir=${placeholder "doc"}/share/doc/$(book_name)"
+    "devhelpdir=${placeholder "devdoc"}/share/devhelp/books/$(book_name)"
+  ];
+
+  # Fontconfig error: Cannot load default config file
+  FONTCONFIG_FILE = makeFontsConf {
+    fontDirectories = [ freefont_ttf ];
+  };
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix PYTHONPATH : "${placeholder "out"}/${python3.sitePackages}"
+      --set PYTHONHOME "${python}"
+    )
+  '';
+
+  meta = with stdenv.lib; {
+    description = "An easy-to-use database designer and user interface";
+    homepage = http://www.glom.org/;
+    license = [ licenses.lgpl2 licenses.gpl2 ];
+    maintainers = gnome3.maintainers;
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/misc/k2pdfopt/default.nix

@@ -75,19 +75,21 @@ stdenv.mkDerivation rec {
         cp ${src}/leptonica_mod/* src/
       '';
     });
-    tesseract_modded = tesseract.overrideAttrs (attrs: {
+    tesseract_modded = tesseract.override {
-      prePatch = ''
+      tesseractBase = tesseract.tesseractBase.overrideAttrs (_: {
-        cp ${src}/tesseract_mod/{ambigs.cpp,ccutil.h,ccutil.cpp} ccutil/
+        prePatch = ''
-        cp ${src}/tesseract_mod/dawg.cpp api/
+          cp ${src}/tesseract_mod/{ambigs.cpp,ccutil.h,ccutil.cpp} ccutil/
-        cp ${src}/tesseract_mod/{imagedata.cpp,tessdatamanager.cpp} ccstruct/
+          cp ${src}/tesseract_mod/dawg.cpp api/
-        cp ${src}/tesseract_mod/openclwrapper.h opencl/
+          cp ${src}/tesseract_mod/{imagedata.cpp,tessdatamanager.cpp} ccstruct/
-        cp ${src}/tesseract_mod/{tessedit.cpp,thresholder.cpp} ccmain/
+          cp ${src}/tesseract_mod/openclwrapper.h opencl/
-        cp ${src}/tesseract_mod/tess_lang_mod_edge.h cube/
+          cp ${src}/tesseract_mod/{tessedit.cpp,thresholder.cpp} ccmain/
-        cp ${src}/tesseract_mod/tesscapi.cpp api/
+          cp ${src}/tesseract_mod/tess_lang_mod_edge.h cube/
-        cp ${src}/include_mod/{tesseract.h,leptonica.h} api/
+          cp ${src}/tesseract_mod/tesscapi.cpp api/
-      '';
+          cp ${src}/include_mod/{tesseract.h,leptonica.h} api/
-      patches = [ ./tesseract.patch ];
+        '';
-    });
+        patches = [ ./tesseract.patch ];
+      });
+    };
   in
     [ zlib libpng ] ++
     optional enableGSL gsl ++

pkgs/applications/misc/llpp/default.nix

@@ -1,33 +1,36 @@
-{ stdenv, lib, makeWrapper, fetchgit, pkgconfig, ninja, ocaml, findlib, mupdf
+{ stdenv, lib, substituteAll, makeWrapper, fetchgit, ocaml, mupdf, libX11,
-, gtk3, openjpeg, jbig2dec, mujs, xsel, openssl, freetype, ncurses }:
+libGLU_combined, freetype, xclip }:
 
-assert lib.versionAtLeast (lib.getVersion ocaml) "4.02";
+assert lib.versionAtLeast (lib.getVersion ocaml) "4.07";
 
 stdenv.mkDerivation rec {
   name = "llpp-${version}";
-  version = "2018-03-02";
+  version = "30";
 
   src = fetchgit {
     url = "git://repo.or.cz/llpp.git";
-    rev = "0ab1fbbf142b6df6d6bae782e3af2ec50f32dec9";
+    rev = "v${version}";
-    sha256 = "1h0hrmxwm7ripgp051788p8ad0q38dc9nvjx87mdwlkwk9qc0dis";
+    sha256 = "0iilpzf12hs0zky58j55l4y5dvzv7fc53nsrg324n9vka92mppvd";
     fetchSubmodules = false;
   };
 
-  nativeBuildInputs = [ pkgconfig makeWrapper ninja ];
+  patches = (substituteAll {
-  buildInputs = [ ocaml findlib mupdf gtk3 jbig2dec openjpeg mujs openssl freetype ncurses ];
+    inherit version;
+    src = ./fix-build-bash.patch;
+  });
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ ocaml mupdf libX11 libGLU_combined freetype ];
 
   dontStrip = true;
 
   configurePhase = ''
-    sed -i -e 's+ocamlc --version+ocamlc -version+' build.sh
+    mkdir -p build/mupdf/thirdparty
-    sed -i -e 's+-I \$srcdir/mupdf/include -I \$srcdir/mupdf/thirdparty/freetype/include+-I ${freetype.dev}/include+' build.sh
+    ln -s ${freetype.dev} build/mupdf/thirdparty/freetype
-    sed -i -e 's+-lmupdf +-lfreetype -lz -lharfbuzz -ljbig2dec -lopenjp2 -ljpeg -lmupdf +' build.sh
-    sed -i -e 's+-L\$srcdir/mupdf/build/native ++' build.sh
   '';
 
   buildPhase = ''
-    sh ./build.sh build
+    bash ./build.bash build
   '';
 
   installPhase = ''
@@ -35,14 +38,14 @@ stdenv.mkDerivation rec {
     install build/llpp $out/bin
     wrapProgram $out/bin/llpp \
         --prefix CAML_LD_LIBRARY_PATH ":" "$out/lib" \
-        --prefix PATH ":" "${xsel}/bin"
+        --prefix PATH ":" "${xclip}/bin"
   '';
 
   meta = with stdenv.lib; {
     homepage = https://repo.or.cz/w/llpp.git;
     description = "A MuPDF based PDF pager written in OCaml";
     platforms = platforms.linux;
-    maintainers = with maintainers; [ pSub ];
+    maintainers = with maintainers; [ pSub enzime ];
     license = licenses.gpl3;
   };
 }

pkgs/applications/misc/llpp/fix-build-bash.patch

@@ -0,0 +1,88 @@
+From cccadedfbcb6764a38382154838113a6b2fd4dee Mon Sep 17 00:00:00 2001
+From: Michael Hoang <enzime@users.noreply.github.com>
+Date: Mon, 10 Dec 2018 15:08:01 +1100
+Subject: [PATCH] Patch build.bash for nixpkgs
+
+---
+ build.bash | 37 ++-----------------------------------
+ 1 file changed, 2 insertions(+), 35 deletions(-)
+
+diff --git a/build.bash b/build.bash
+index 1588011..72117d9 100755
+--- a/build.bash
++++ b/build.bash
+@@ -29,7 +29,6 @@ srcd="$(dirname $0)"
+ mudir=$outd/mupdf
+ muinc="-I $mudir/include -I $mudir/thirdparty/freetype/include"
+ 
+-test -d "$mudir" || die muPDF not found, consult $(dirname $0)/BUILDING
+ 
+ mkdir -p $outd/{$wsid,lablGL}
+ :>$outd/ordered
+@@ -39,12 +38,6 @@ isfresh() { test -r "$1.past" && . "$1.past" && test "$k" = "$2"; }
+ mbt=native
+ mulibs="$mudir/build/$mbt/libmupdf.a" # $mudir/build/$mbt/libmupdf-third.a
+ 
+-keycmd="(cd $mudir && git describe --tags --dirty); digest $mulibs"
+-isfresh "$mulibs" "$(eval $keycmd)" || (
+-    make -C "$mudir" build=$mbt -j $mjobs libs
+-    echo "k='$(eval $keycmd)'" >$mudir/build/$mbt/libmupdf.a.past
+-) && vecho "fresh mupdf"
+-
+ oincs() {
+     local i=
+     local incs1=
+@@ -90,32 +83,6 @@ mflags() {
+ }
+ 
+ overs="$(ocamlc -vnum 2>/dev/null)" || overs=""
+-test "$overs" = "4.07.0" || {
+-    url=https://caml.inria.fr/pub/distrib/ocaml-4.07/ocaml-4.07.0.tar.xz
+-    txz=$outd/$(basename $url)
+-    isfresh $txz $url || {
+-        executable_p() { command -v "$1" >/dev/null 2>&1; }
+-        if executable_p wget; then dl() { wget -q "$1" -O "$2"; }
+-        elif executable_p curl; then dl() { curl -L "$1" -o "$2"; }
+-        else die "no program to fetch remote urls found"
+-        fi
+-        dl $url $txz
+-        echo "k=$url" >$txz.past
+-    } && vecho "fresh $txz"
+-    absprefix=$(cd $outd &>/dev/null; pwd -P)
+-    export PATH=$absprefix/bin:$PATH
+-    isfresh $absprefix/bin/ocamlc "$url" || (
+-        tar xf $txz -C $outd
+-        bn=$(basename $url)
+-        cd $outd/${bn%.tar.xz}
+-        ./configure -prefix $absprefix                                      \
+-                    -no-graph -no-debugger -no-ocamldoc -no-native-compiler
+-        make -j $mjobs world
+-        make install
+-        echo "k='$url'" >$absprefix/bin/ocamlc.past
+-    ) && vecho "fresh ocamlc"
+-    overs=$(ocamlc -vnum 2>/dev/null)
+-}
+ 
+ bocaml1() {
+     grep -q "$3" $outd/ordered || {
+@@ -224,7 +191,7 @@ bobjc() {
+     } && vecho "fresh $o"
+ }
+ 
+-ver=$(cd $srcd && git describe --tags --dirty) || ver=unknown
++ver=@version@
+ 
+ cmd="(. $srcd/genconfstr.sh >$outd/confstruct.ml)"
+ keycmd="digest $srcd/genconfstr.sh $outd/confstruct.ml"
+@@ -278,7 +245,7 @@ for m in ml_gl ml_glarray ml_raw; do
+ done
+ 
+ libs="str.cma unix.cma"
+-clibs="-L$mudir/build/$mbt -lmupdf -lmupdf-third -lpthread"
++clibs="-lmupdf -lfreetype -lpthread"
+ if $darwin; then
+     mcomp=$(ocamlc -config | grep bytecomp_c_co | { read _ c; echo $c; })
+     clibs="$clibs -framework Cocoa -framework OpenGL"
+-- 
+2.19.2
+

pkgs/applications/misc/pgmanage/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "pgmanage-${version}";
-  version = "10.3.1";
+  version = "11.0.1";
 
   src = fetchFromGitHub {
     owner  = "pgManage";
     repo   = "pgManage";
     rev    = "v${version}";
-    sha256 = "0ym1arla9wfkmr5n6h6dfyd680vlnng5s5j5nyxi2gl2wxqqhxzz";
+    sha256 = "1a1dbc32b3y0ph8ydf800h6pz7dg6g1gxgid4gffk7k58xj0c5yf";
   };
 
   patchPhase = ''

pkgs/applications/misc/playonlinux/default.nix

@@ -22,7 +22,7 @@
 }:
 
 let
-  version = "4.2.12";
+  version = "4.3.3";
 
   binpath = stdenv.lib.makeBinPath
     [ cabextract
@@ -55,7 +55,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.playonlinux.com/script_files/PlayOnLinux/${version}/PlayOnLinux_${version}.tar.gz";
-    sha256 = "03k8v9dknc5hfrfzqw1nkpifz7wkixv3mvjl1vnp4fx8rj2xrjrq";
+    sha256 = "117xivwa87i2w66klplmwd5q7pfxcbrj2rjm11wl8iy5h3xpqkak";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/misc/qmapshack/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "qmapshack-${version}";
-  version = "1.12.0";
+  version = "1.12.1";
 
   src = fetchurl {
     url = "https://bitbucket.org/maproom/qmapshack/downloads/${name}.tar.gz";
-    sha256 = "0d5p60kq9pa2hfql4nr8p42n88lr42jrsryrsllvaj45b8b6kvih";
+    sha256 = "1d6n7xk0ksxb1fw43s5lb08vgxf6h93k3rb401cbka1inpyf2232";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/misc/soapysdr/default.nix

@@ -19,7 +19,7 @@ in stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
-  buildInputs = [ libusb ncurses numpy swig2 python ];
+  buildInputs = [ libusb ncurses numpy swig2 python makeWrapper ];
 
   cmakeFlags = [
     "-DCMAKE_BUILD_TYPE=Release"
@@ -33,8 +33,8 @@ in stdenv.mkDerivation {
     done
 
     # Needed for at least the remote plugin server
-    for file in out/bin/*; do
+    for file in $out/bin/*; do
-        ${makeWrapper}/bin/wrapProgram "$file" \
+        wrapProgram "$file" \
             --prefix SOAPY_SDR_PLUGIN_PATH : ${lib.makeSearchPath "lib/SoapySDR/modules0.6" extraPackages}
     done
   '';

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "03ddfxxzh8pxil9n28y8nkzl8x0kb5bzzjy4mihg448dflh3anq2";
+    sha256 = "1xcdbf5yia3xm0kil0gyd1mlj3m902w1px3lzpdqv31mr2lzaz08";
-    sha256bin64 = "147lh1way8db0j0m6wbpfzmfsvvlsjb29cjgf7s9hljb00wqv6ay";
+    sha256bin64 = "0pcbz3201nyl07psdxwphb3z9shqj4crj16f97xclyvjnwpl1jnp";
-    version = "71.0.3578.80";
+    version = "72.0.3626.28";
   };
   dev = {
-    sha256 = "0whw1kq5gd07k061ycfdn7bygahbl6zqa54wkz2lqh73yknbbnj4";
+    sha256 = "1vlpcafg3xx6bpnf74xs6ifqjbpb5bpxp10r55w4784yr57pmhq3";
-    sha256bin64 = "0hlfzzf7kx90jw0zin685c4haiv262hf9a4sj6fmb2yhj21hbp87";
+    sha256bin64 = "02y974zbxy1gbiv9q8hp7nfl0l5frn35ggmgc44g90pbry48h8rg";
-    version = "72.0.3622.0";
+    version = "73.0.3642.0";
   };
   stable = {
-    sha256 = "03ddfxxzh8pxil9n28y8nkzl8x0kb5bzzjy4mihg448dflh3anq2";
+    sha256 = "0icxdg4fvz30jzq0xvl11zlwc9anb3lr9lb8sn1lqxr513isjmhw";
-    sha256bin64 = "1rnw3whn2aaxxb4w3s2nf0wb91qjrq099550j42wig7xa71j6rz4";
+    sha256bin64 = "07kiqx5bpk54il0ynxl61bs5yscxb470q2bw3sx6cxjbhmnvbcn2";
-    version = "71.0.3578.80";
+    version = "71.0.3578.98";
   };
 }

pkgs/applications/networking/browsers/midori/default.nix

@@ -1,54 +1,31 @@
-{ stdenv, fetchurl, cmake, pkgconfig, intltool, vala_0_34, wrapGAppsHook
+{ stdenv, fetchurl, cmake, ninja, pkgconfig, intltool, vala, wrapGAppsHook
-, gtk3, webkitgtk, librsvg, libnotify, sqlite
+, gtk3, webkitgtk, sqlite, gsettings-desktop-schemas, libsoup, glib-networking, gnome3
-, glib-networking, gsettings-desktop-schemas, libsoup, pcre, gnome3
-, libxcb, libpthreadstubs, libXdmcp, libxkbcommon, epoxy, at-spi2-core
-, zeitgeistSupport ? false, zeitgeist ? null
 }:
 
-assert zeitgeistSupport -> zeitgeist != null;
-
 stdenv.mkDerivation rec {
-  name = "midori-${version}";
+  pname = "midori";
-  version = "0.5.11";
+  version = "7";
+
+  src = fetchurl {
+    url = "https://github.com/midori-browser/core/releases/download/v${version}/midori-v${version}.0.tar.gz";
+    sha256 = "0ffdnjp55s0ci737vlhxikb2nihghwlb6mjcjzpgpnzi47vjqnwh";
+  };
+
+  nativeBuildInputs = [
+    pkgconfig cmake ninja intltool vala wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtk3 webkitgtk sqlite gsettings-desktop-schemas gnome3.gcr
+    (libsoup.override { gnomeSupport = true; }) gnome3.libpeas
+    glib-networking
+  ];
 
   meta = with stdenv.lib; {
     description = "Lightweight WebKitGTK+ web browser";
-    homepage = http://midori-browser.org;
+    homepage = https://www.midori-browser.org/;
     license = with licenses; [ lgpl21Plus ];
     platforms = with platforms; linux;
     maintainers = with maintainers; [ raskin ramkromberg ];
   };
-
-  src = fetchurl {
-    urls = [
-      "${meta.homepage}/downloads/midori_${version}_all_.tar.bz2"
-      "http://mirrors-ru.go-parts.com/blfs/conglomeration/midori/midori_${version}_all_.tar.bz2"
-    ];
-    name = "midori_${version}_all_.tar.bz2";
-    sha256 = "0gcwqkcyliqz10i33ww3wl02mmfnl7jzl2d493l4l53ipsb1l6cn";
-  };
-
-  nativeBuildInputs = [
-    pkgconfig wrapGAppsHook cmake intltool vala_0_34
-  ];
-
-  buildInputs = [
-    gtk3 webkitgtk librsvg libnotify sqlite gsettings-desktop-schemas pcre gnome3.gcr
-    libxcb libpthreadstubs libXdmcp libxkbcommon epoxy at-spi2-core
-    (libsoup.override {gnomeSupport = true;})
-  ] ++ stdenv.lib.optionals zeitgeistSupport [
-    zeitgeist
-  ];
-
-  cmakeFlags = [
-    "-DUSE_ZEITGEIST=${if zeitgeistSupport then "ON" else "OFF"}"
-    "-DHALF_BRO_INCOM_WEBKIT2=ON"
-    "-DUSE_GTK3=1"
-  ];
-
-  NIX_LDFLAGS="-lX11";
-
-  preFixup = ''
-    gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" --prefix GIO_EXTRA_MODULES : "${glib-networking.out}/lib/gio/modules")
-  '';
 }

pkgs/applications/networking/browsers/qutebrowser/default.nix

@@ -10,20 +10,14 @@
 assert withMediaPlayback -> gst_all_1 != null;
 
 let
-  pdfjs = stdenv.mkDerivation rec {
+  pdfjs = let
-    name = "pdfjs-${version}";
     version = "1.10.100";
-
+  in
-    src = fetchzip {
+  fetchzip rec {
-      url = "https://github.com/mozilla/pdf.js/releases/download/${version}/${name}-dist.zip";
+    name = "pdfjs-${version}";
-      sha256 = "04df4cf6i6chnggfjn6m1z9vb89f01a0l9fj5rk21yr9iirq9rkq";
+    url = "https://github.com/mozilla/pdf.js/releases/download/v${version}/${name}-dist.zip";
-      stripRoot = false;
+    sha256 = "04df4cf6i6chnggfjn6m1z9vb89f01a0l9fj5rk21yr9iirq9rkq";
-    };
+    stripRoot = false;
-
-    buildCommand = ''
-      mkdir $out
-      cp -r $src $out
-    '';
   };
 
 in python3Packages.buildPythonApplication rec {

pkgs/applications/networking/browsers/surf/default.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   inherit patches;
 
-  installFlags = [ "PREFIX=/" "DESTDIR=$(out)" ];
+  installFlags = [ "PREFIX=$(out)" ];
 
   meta = with stdenv.lib; {
     description = "A simple web browser based on WebKit/GTK+";

pkgs/applications/networking/cluster/cni/default.nix

@@ -1,6 +1,6 @@
-{ stdenv, fetchFromGitHub, go, removeReferencesTo }:
+{ stdenv, fetchFromGitHub, buildGoPackage }:
 
-stdenv.mkDerivation rec {
+buildGoPackage rec {
   name = "cni-${version}";
   version = "0.6.0";
 
@@ -11,29 +11,23 @@ stdenv.mkDerivation rec {
     sha256 = "00ajs2r5r2z3l0vqwxrcwhjfc9px12qbcv5vnvs2mdipvvls1y2y";
   };
 
-  buildInputs = [ removeReferencesTo go ];
+  goPackagePath = "github.com/containernetworking/cni";
-
-  GOCACHE = "off";
 
   buildPhase = ''
+    cd "go/src/${goPackagePath}"
     patchShebangs build.sh
     ./build.sh
   '';
 
   installPhase = ''
-    mkdir -p $out/bin
+    install -Dm555 bin/cnitool $bin/bin/cnitool
-    mv bin/cnitool $out/bin
-  '';
-
-  preFixup = ''
-    find $out/bin -type f -exec remove-references-to -t ${go} '{}' +
   '';
 
   meta = with stdenv.lib; {
     description = "Container Network Interface - networking for Linux containers";
     license = licenses.asl20;
     homepage = https://github.com/containernetworking/cni;
-    maintainers = with maintainers; [offline];
+    maintainers = with maintainers; [ offline vdemeester ];
     platforms = [ "x86_64-linux" ];
   };
 }

pkgs/applications/networking/cluster/luigi/default.nix

@@ -19,6 +19,9 @@ python3Packages.buildPythonApplication rec {
   # Requires tox, hadoop, and google cloud
   doCheck = false;
 
+  # This enables accessing modules stored in cwd
+  makeWrapperArgs = ["--prefix PYTHONPATH . :"];
+
   meta = with lib; {
     homepage = https://github.com/spotify/luigi;
     description = "Python package that helps you build complex pipelines of batch jobs";

pkgs/applications/networking/cluster/pig/default.nix

@@ -2,15 +2,15 @@
 
 stdenv.mkDerivation rec {
 
-  name = "pig-0.16.0";
+  name = "pig-0.17.0";
 
   src = fetchurl {
     url = "mirror://apache/pig/${name}/${name}.tar.gz";
-    sha256 = "0p79grz5islnq195lv7pqdxb5l3v4y0k0w63602827qs70zpr508";
+    sha256 = "1wwpg0w47f49rnivn2d26vrxgyfl9gpqx3vmzbl5lhx6x5l3fqbd";
 
   };
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     mkdir -p $out
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://pig.apache.org/;
+    homepage = https://pig.apache.org/;
     description = "High-level language for Apache Hadoop";
     license = licenses.asl20;
 

pkgs/applications/networking/cluster/terragrunt/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "terragrunt-${version}";
-  version = "0.17.3";
+  version = "0.17.4";
 
   goPackagePath = "github.com/gruntwork-io/terragrunt";
 
@@ -10,7 +10,7 @@ buildGoPackage rec {
     owner  = "gruntwork-io";
     repo   = "terragrunt";
     rev    = "v${version}";
-    sha256 = "1b0fwql9nr00qpvcbsbdymxf1wrgr590gkms7yz3yirb4xfl3gl3";
+    sha256 = "13hlv0ydmv8gpzgg6bfr7rp89xfw1bkgd0j684armw8zq29cmv3a";
   };
 
   goDeps = ./deps.nix;

pkgs/applications/networking/flexget/default.nix

@@ -1,8 +1,4 @@
-{ lib, python
+{ lib, python36 }:
-, delugeSupport ? true, deluge ? null
-}:
-
-assert delugeSupport -> deluge != null;
 
 # Flexget have been a trouble maker in the past,
 # if you see flexget breaking when updating packages, don't worry.
@@ -10,17 +6,9 @@ assert delugeSupport -> deluge != null;
 # -- Mic92
 
 let
-  python' = python.override { inherit packageOverrides; };
+  python' = python36.override { inherit packageOverrides; };
 
   packageOverrides = self: super: {
-    sqlalchemy = super.sqlalchemy.overridePythonAttrs (old: rec {
-      version = "1.2.6";
-      src = old.src.override {
-        inherit version;
-        sha256 = "1nwylglh256mbwwnng6n6bzgxshyz18j12hw76sghbprp74hrc3w";
-      };
-    });
-
     guessit = super.guessit.overridePythonAttrs (old: rec {
       version = "3.0.3";
       src = old.src.override {
@@ -36,14 +24,16 @@ with python'.pkgs;
 
 buildPythonApplication rec {
   pname = "FlexGet";
-  version = "2.17.14";
+  version = "2.17.20";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1wh12nspjzsgb0a7qp67s4k8wssbhhf500s8x8mx2smb1mgy4xzz";
+    sha256 = "a09ef9482ed54f7e96eb8b4d08c59687c5c43a3341c9d2675383693e6c3681c3";
   };
 
   postPatch = ''
+    # build for the correct python version
+    substituteInPlace setup.cfg --replace $'[bdist_wheel]\npython-tag = py27' ""
     # remove dependency constraints
     sed 's/==\([0-9]\.\?\)\+//' -i requirements.txt
   '';
@@ -52,25 +42,20 @@ buildPythonApplication rec {
   doCheck = false;
 
   propagatedBuildInputs = [
+    # See https://github.com/Flexget/Flexget/blob/master/requirements.in
     feedparser sqlalchemy pyyaml
-    chardet beautifulsoup4 html5lib
+    beautifulsoup4 html5lib
     PyRSS2Gen pynzb rpyc jinja2
-    jsonschema requests dateutil
+    requests dateutil jsonschema
     pathpy guessit APScheduler
     terminaltables colorclass
     cherrypy flask flask-restful
     flask-restplus flask-compress
-    flask_login flask-cors safe
+    flask_login flask-cors
-    pyparsing future zxcvbn-python
+    pyparsing zxcvbn-python future
-    werkzeug tempora cheroot rebulk
+    # Optional requirements
-    portend transmissionrpc aniso8601
+    deluge-client
-    babelfish certifi click futures
+  ] ++ lib.optional (pythonOlder "3.4") pathlib;
-    idna itsdangerous markupsafe
-    plumbum pytz six tzlocal urllib3
-    webencodings werkzeug zxcvbn-python
-    backports_functools_lru_cache
-  ] ++ lib.optional (pythonOlder "3.4") pathlib
-    ++ lib.optional delugeSupport deluge;
 
   meta = with lib; {
     homepage    = https://flexget.com/;

pkgs/applications/networking/gns3/server.nix

@@ -1,10 +1,10 @@
 { stable, branch, version, sha256Hash }:
 
-{ stdenv, python3Packages, fetchFromGitHub, fetchurl }:
+{ stdenv, python36Packages, fetchFromGitHub, fetchurl }:
 
 let
-  pythonPackages = python3Packages;
+  pythonPackages = python36Packages;
-  async-timeout = (stdenv.lib.overrideDerivation pythonPackages.async-timeout
+  async-timeout = pythonPackages.async-timeout.overrideAttrs
     (oldAttrs:
       rec {
         pname = "async-timeout";
@@ -13,8 +13,8 @@ let
           inherit pname version;
           sha256 = "1l3kg062m02mph6rf9rdv8r5c5n356clxa6b6mrn0i77vk9g9kq0";
         };
-      }));
+      });
-  aiohttp = (stdenv.lib.overrideDerivation pythonPackages.aiohttp
+  aiohttp = pythonPackages.aiohttp.overrideAttrs
     (oldAttrs:
       rec {
         pname = "aiohttp";
@@ -24,10 +24,9 @@ let
           sha256 = "8adda6583ba438a4c70693374e10b60168663ffa6564c5c75d3c7a9055290964";
         };
         propagatedBuildInputs = [ async-timeout ]
-          ++ (with pythonPackages; [ attrs chardet multidict yarl ])
+          ++ (with pythonPackages; [ attrs chardet multidict yarl idna-ssl ]);
-          ++ stdenv.lib.optional (pythonPackages.pythonOlder "3.7") pythonPackages.idna-ssl;
+      });
-      }));
+  aiohttp-cors = pythonPackages.aiohttp-cors.overrideAttrs
-  aiohttp-cors = (stdenv.lib.overrideDerivation pythonPackages.aiohttp-cors
     (oldAttrs:
       rec {
         pname = "aiohttp-cors";
@@ -41,7 +40,7 @@ let
           ++ stdenv.lib.optional
                (pythonPackages.pythonOlder "3.5")
                pythonPackages.typing;
-      }));
+      });
 in pythonPackages.buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "gns3-server";
@@ -57,7 +56,7 @@ in pythonPackages.buildPythonPackage rec {
     ++ (with pythonPackages; [
       yarl aiohttp multidict
       jinja2 psutil zipstream raven jsonschema typing
-      prompt_toolkit
+      (pythonPackages.callPackage ../../../development/python-modules/prompt_toolkit/1.nix {})
     ]);
 
   # Requires network access

pkgs/applications/networking/instant-messengers/pidgin-plugins/msn-pecan/default.nix

@@ -13,9 +13,10 @@ stdenv.mkDerivation {
     platforms = stdenv.lib.platforms.linux;
   };
 
-  makeFlags = "PURPLE_LIBDIR=lib PURPLE_DATADIR=share/data DESTDIR=$$out";
+  makeFlags = [
-  preInstall = "mkdir -p \$out/share";
+    "PURPLE_LIBDIR=${placeholder "out"}/lib"
-  postInstall = "ln -s \$out/lib/purple-2 \$out/share/pidgin-msn-pecan";
+    "PURPLE_DATADIR=${placeholder "out"}/share/data"
+  ];
 
   buildInputs = [pidgin];
 }

pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-mra/default.nix

@@ -15,13 +15,16 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ pidgin ];
 
-  preConfigure = ''
+  postPatch = ''
     sed -i 's|-I/usr/include/libpurple|$(shell pkg-config --cflags purple)|' Makefile
-    export DESTDIR=$out
-    export LIBDIR=/lib
-    export DATADIR=/share
   '';
 
+  makeFlags = [
+    "DESTDIR=/"
+    "LIBDIR=${placeholder "out"}/lib"
+    "DATADIR=${placeholder "out"}/share"
+  ];
+
   meta = {
     homepage = https://github.com/dreadatour/pidgin-mra;
     description = "Mail.ru Agent plugin for Pidgin / libpurple";

pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-opensteamworks/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pidgin, unzip, glib, json-glib, nss, nspr, libgnome-keyring } :
+{ stdenv, fetchFromGitHub, pidgin, glib, json-glib, nss, nspr, libgnome-keyring } :
 
 stdenv.mkDerivation rec {
   name = "pidgin-opensteamworks-${version}";
@@ -13,12 +13,11 @@ stdenv.mkDerivation rec {
 
   preConfigure = "cd steam-mobile";
   installFlags = [
-    "DESTDIR=$(out)"
+    "PLUGIN_DIR_PURPLE=${placeholder "out"}/lib/purple-2"
-    "PLUGIN_DIR_PURPLE=/lib/purple-2"
+    "DATA_ROOT_DIR_PURPLE=${placeholder "out"}/share"
-    "DATA_ROOT_DIR_PURPLE=/share"
   ];
 
-  buildInputs = [ pidgin unzip glib json-glib nss nspr libgnome-keyring ];
+  buildInputs = [ pidgin glib json-glib nss nspr libgnome-keyring ];
 
   meta = with stdenv.lib; {
     homepage = https://github.com/EionRobb/pidgin-opensteamworks;

pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-skypeweb/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "pidgin-skypeweb-${version}";
-  version = "1.2.2";
+  version = "1.5";
 
   src = fetchFromGitHub {
     owner = "EionRobb";
     repo = "skype4pidgin";
-    rev = "${version}";
+    rev = version;
-    sha256 = "1lxpz316jmns6i143v4j6sd6k0a4a54alw08rvwjckf2rig57lj2";
+    sha256 = "1bd9gd36yhrbrww0dvai9rnzxxj1c9sb4003c72wg27w12y47xfv";
   };
 
   setSourceRoot = ''
@@ -18,13 +18,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ pidgin json-glib ];
 
-  makeFlags = [
+  PKG_CONFIG_PURPLE_PLUGINDIR = "${placeholder "out"}/lib/purple-2";
-    "PLUGIN_DIR_PURPLE=/lib/pidgin/"
+  PKG_CONFIG_PURPLE_DATADIR = "${placeholder "out"}/share";
-    "DATA_ROOT_DIR_PURPLE=/share"
-    "DESTDIR=$(out)"
-  ];
-
-  postInstall = "ln -s \$out/lib/pidgin \$out/share/pidgin-skypeweb";
 
   meta = with stdenv.lib; {
     homepage = https://github.com/EionRobb/skype4pidgin;

pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-discord/default.nix

@@ -14,12 +14,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ pidgin json-glib ];
 
-  makeFlags = [
+  PKG_CONFIG_PURPLE_PLUGINDIR = "${placeholder "out"}/lib/purple-2";
-    "DESTDIR=$(out)"
+  PKG_CONFIG_PURPLE_DATADIR = "${placeholder "out"}/share";
-  ];
-
-  PKG_CONFIG_PURPLE_PLUGINDIR = "/lib/purple-2";
-  PKG_CONFIG_PURPLE_DATADIR = "/share";
 
   meta = with stdenv.lib; {
     homepage = https://github.com/EionRobb/purple-discord;

pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix

@@ -18,9 +18,8 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "fortify" ]; # upstream compiles with -O0
 
   makeFlags = [
-    "DESTDIR=$(out)"
+    "PLUGIN_DIR_PURPLE=${placeholder "out"}/lib/purple-2"
-    "PLUGIN_DIR_PURPLE=/lib/pidgin/"
+    "DATA_ROOT_DIR_PURPLE=${placeholder "out"}/share"
-    "DATA_ROOT_DIR_PURPLE=/share"
   ];
 
   meta = with stdenv.lib; {

pkgs/applications/networking/instant-messengers/riot/riot-web.nix

@@ -3,11 +3,11 @@
 let configFile = writeText "riot-config.json" conf; in
 stdenv.mkDerivation rec {
   name= "riot-web-${version}";
-  version = "0.17.6";
+  version = "0.17.8";
 
   src = fetchurl {
     url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "1y38fq0r9cxmazh9rjc5qy7fzwy81ad35k538d6rsfwz1y88ipdm";
+    sha256 = "0610h307q0zlyd0l7afrb8jv1r9gy9gc07zkjn33jpycwmpbwxbz";
   };
 
   installPhase = ''

pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix

@@ -4,8 +4,8 @@ let
   mkTelegram = args: qt5.callPackage (import ./generic.nix args) { };
   stableVersion = {
     stable = true;
-    version = "1.5.2";
+    version = "1.5.4";
-    sha256Hash = "0kg1xw1b4zj5a2yf6x5r7wrpl7w0fs52s58w606n9gyx7kdcgkj8";
+    sha256Hash = "0a52m5qkvk01yl3za3k7pccjrqkr8gbxqnj5lnhh1im1pdxqwh4m";
     # svn log svn://svn.archlinux.org/community/telegram-desktop/trunk
     archPatchesRevision = "415526";
     archPatchesHash = "1lfzws90ab0vajhm5r64gyyqqc1g6a2ay0a1vkp0ah1iw5jh11ik";

pkgs/applications/networking/instant-messengers/telegram/tdesktop/generic.nix

@@ -29,7 +29,9 @@ mkDerivation rec {
   };
 
   # TODO: libtgvoip.patch no-gtk2.patch
-  patches = [ "${archPatches}/tdesktop.patch" ]
+  patches = [
+      "${archPatches}/tdesktop.patch"
+    ]
     # TODO: Only required to work around a compiler bug.
     # This should be fixed in GCC 7.3.1 (or later?)
     ++ [ ./fix-internal-compiler-error.patch ];

pkgs/applications/networking/syncplay/default.nix

@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   name = "syncplay-${version}";
-  version = "1.6.0";
+  version = "1.6.1";
 
   format = "other";
 
   src = fetchurl {
-    url = https://github.com/Syncplay/syncplay/archive/v1.6.0.tar.gz;
+    url = https://github.com/Syncplay/syncplay/archive/v1.6.1.tar.gz;
-    sha256 = "19x7b694p8b3qp578qk8q4g0pybhfjd4zk8rgrggz40s1yyfnwy5";
+    sha256 = "15rhbc3r7l012d330hb64p8bhcpy4ydy89iv34c34a1r554b8k97";
   };
 
   propagatedBuildInputs = with python3Packages; [ pyside twisted ];

pkgs/applications/networking/syncthing/default.nix

@@ -3,14 +3,14 @@
 let
   common = { stname, target, postInstall ? "" }:
     buildGoPackage rec {
-      version = "0.14.52";
+      version = "0.14.54";
       name = "${stname}-${version}";
 
       src = fetchFromGitHub {
         owner  = "syncthing";
         repo   = "syncthing";
         rev    = "v${version}";
-        sha256 = "1qzzbqfyjqlgzysyf6dr0xsm3gn35irmllxjjd94v169swvkk5kd";
+        sha256 = "0l73ka71l6gxv46wmlyzj8zhfpfj3vf6nv6x3x0z25ymr3wa2fza";
       };
 
       goPackagePath = "github.com/syncthing/syncthing";

pkgs/applications/office/gnumeric/default.nix

@@ -5,33 +5,23 @@
 
 let
   inherit (pythonPackages) python pygobject3;
-  isopub = fetchurl { url = http://www.oasis-open.org/docbook/xml/4.5/ent/isopub.ent; sha256 = "073l492jz70chcadr2p7ssx7gz5hd731s2cazhxx4r845kilyr77"; };
-  isonum = fetchurl { url = http://www.oasis-open.org/docbook/xml/4.5/ent/isonum.ent; sha256 = "04b62dw2g3cj9i4vn9xyrsrlz8fpmmijq98dm0nrkky31bwbbrs3"; };
-  isogrk1 = fetchurl { url = http://www.oasis-open.org/docbook/xml/4.5/ent/isogrk1.ent; sha256 = "04b23anhs5wr62n4rgsjirzvw7rpjcsf8smz4ffzaqh3b0vw90vm"; };
 in stdenv.mkDerivation rec {
-  name = "gnumeric-1.12.43";
+  pname = "gnumeric";
+  version = "1.12.44";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/gnumeric/1.12/${name}.tar.xz";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "87c9abd6260cf29401fa1e0fcce374e8c7bcd1986608e4049f6037c9d32b5fd5";
+    sha256 = "0147962c6ybdsj57rz95nla0rls7g545wc2n7pz59zmzyd5pksk0";
   };
 
   configureFlags = [ "--disable-component" ];
 
-  prePatch = ''
+  nativeBuildInputs = [ pkgconfig intltool bison itstool makeWrapper ];
-    substituteInPlace doc/C/gnumeric.xml \
-      --replace http://www.oasis-open.org/docbook/xml/4.5/ent/isopub.ent ${isopub} \
-      --replace http://www.oasis-open.org/docbook/xml/4.5/ent/isonum.ent ${isonum} \
-      --replace http://www.oasis-open.org/docbook/xml/4.5/ent/isogrk1.ent ${isogrk1}
-  '';
-
-  nativeBuildInputs = [ pkgconfig ];
 
   # ToDo: optional libgda, introspection?
   buildInputs = [
-    intltool bison
+    goffice gtk3 gnome3.defaultIconTheme
-    goffice gtk3 makeWrapper gnome3.defaultIconTheme
+    python pygobject3
-    python pygobject3 itstool
   ] ++ (with perlPackages; [ perl XMLParser ]);
 
   enableParallelBuilding = true;
@@ -44,6 +34,12 @@ in stdenv.mkDerivation rec {
     done
   '';
 
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
   meta = with stdenv.lib; {
     description = "The GNOME Office Spreadsheet";
     license = stdenv.lib.licenses.gpl2Plus;

pkgs/applications/office/zim/default.nix

@@ -9,11 +9,11 @@
 
 python2Packages.buildPythonApplication rec {
   name = "zim-${version}";
-  version = "0.68";
+  version = "0.69";
 
   src = fetchurl {
     url = "http://zim-wiki.org/downloads/${name}.tar.gz";
-    sha256 = "05fzb24a2s3pm89zb6gwa48wb925an5i652klx8yk9pn23h1h5fr";
+    sha256 = "1j04l1914iw87b0jd3r1czrh0q491fdgbqbi0biacxiri5q0i6a1";
   };
 
   propagatedBuildInputs = with python2Packages; [ pyGtkGlade pyxdg pygobject2 ];
@@ -42,5 +42,6 @@ python2Packages.buildPythonApplication rec {
     homepage = http://zim-wiki.org;
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ pSub ];
+    broken = stdenv.isDarwin; # https://github.com/NixOS/nixpkgs/pull/52658#issuecomment-449565790
   };
 }

pkgs/applications/science/biology/picard-tools/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "picard-tools-${version}";
-  version = "2.18.17";
+  version = "2.18.20";
 
   src = fetchurl {
     url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "0ks7ymrjfya5h77hp0bqyipzdri0kf97c8wks32nvwkj821687zm";
+    sha256 = "0dx6fxn6d7mawkah242fdi9wm8pdzmm4m004fb9ak2fsvrs2m5pk";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/science/electronics/dsview/default.nix

@@ -0,0 +1,47 @@
+{ stdenv, fetchFromGitHub, pkgconfig, cmake, autoreconfHook,
+glib, libzip, boost, fftw, qtbase,
+libusb, makeWrapper, libsigrok4dsl, libsigrokdecode4dsl
+}:
+
+stdenv.mkDerivation rec {
+  name = "dsview-${version}";
+
+  version = "0.99";
+
+  src = fetchFromGitHub {
+      owner = "DreamSourceLab";
+      repo = "DSView";
+      rev = version;
+      sha256 = "189i3baqgn8k3aypalayss0g489xi0an9hmvyggvxmgg1cvcwka2";
+  };
+
+  postUnpack = ''
+    export sourceRoot=$sourceRoot/DSView
+  '';
+
+  patches = [
+    # Fix absolute install paths
+    ./install.patch
+  ];
+
+  nativeBuildInputs = [ cmake pkgconfig makeWrapper ];
+
+  buildInputs = [
+   boost fftw qtbase libusb libzip libsigrokdecode4dsl libsigrok4dsl
+  ];
+
+  enableParallelBuilding = true;
+
+  postFixup = ''
+    wrapProgram $out/bin/DSView --suffix QT_PLUGIN_PATH : \
+      ${qtbase.bin}/${qtbase.qtPluginPrefix}
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A GUI program for supporting various instruments from DreamSourceLab, including logic analyzer, oscilloscope, etc";
+    homepage = http://www.dreamsourcelab.com/;
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.bachp ];
+  };
+}

pkgs/applications/science/electronics/dsview/install.patch

@@ -0,0 +1,15 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index c1c33e1..208a184 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -403,8 +403,8 @@ install(DIRECTORY res DESTINATION share/${PROJECT_NAME})
+ install(FILES icons/logo.png DESTINATION share/${PROJECT_NAME} RENAME logo.png)
+ install(FILES ../NEWS DESTINATION share/${PROJECT_NAME} RENAME NEWS)
+ install(FILES ../ug.pdf DESTINATION share/${PROJECT_NAME} RENAME ug.pdf)
+-install(FILES DreamSourceLab.rules DESTINATION /etc/udev/rules.d/)
+-install(FILES DSView.desktop DESTINATION /usr/share/applications/)
++install(FILES DreamSourceLab.rules DESTINATION etc/udev/rules.d/)
++install(FILES DSView.desktop DESTINATION share/applications/)
+ 
+ #===============================================================================
+ #= Packaging (handled by CPack)

pkgs/applications/science/electronics/dsview/libsigrok4dsl.nix

@@ -0,0 +1,28 @@
+{ stdenv, pkgconfig, autoreconfHook,
+glib, libzip, libserialport, check, libusb, libftdi,
+systemd, alsaLib, dsview
+}:
+
+stdenv.mkDerivation rec {
+  inherit (dsview) version src;
+
+  name = "libsigrok4dsl-${version}";
+
+  postUnpack = ''
+    export sourceRoot=$sourceRoot/libsigrok4DSL
+  '';
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+
+  buildInputs = [
+    glib libzip libserialport libusb libftdi systemd check alsaLib
+  ];
+
+  meta = with stdenv.lib; {
+    description = "A fork of the sigrok library for usage with DSView";
+    homepage = http://www.dreamsourcelab.com/;
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.bachp ];
+  };
+}

pkgs/applications/science/electronics/dsview/libsigrokdecode4dsl.nix

@@ -0,0 +1,27 @@
+{ stdenv, pkgconfig, autoreconfHook,
+glib, check, python3, dsview
+}:
+
+stdenv.mkDerivation rec {
+  inherit (dsview) version src;
+
+  name = "libsigrokdecode4dsl-${version}";
+
+  postUnpack = ''
+    export sourceRoot=$sourceRoot/libsigrokdecode4DSL
+  '';
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+
+  buildInputs = [
+    python3 glib check
+  ];
+
+  meta = with stdenv.lib; {
+    description = "A fork of the sigrokdecode library for usage with DSView";
+    homepage = http://www.dreamsourcelab.com/;
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.bachp ];
+  };
+}

pkgs/applications/science/electronics/verilator/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name    = "verilator-${version}";
-  version = "4.006";
+  version = "4.008";
 
   src = fetchurl {
     url    = "https://www.veripool.org/ftp/${name}.tgz";
-    sha256 = "0vnybpknf4llw3fw800ffiqj89ilbq06j8b2x4syj2gsrlnjvp1i";
+    sha256 = "1b0cj7bb2a3hrfaziix7p9idcpbygapdl0nrfr3pbdxxsgnzdknm";
   };
 
   enableParallelBuilding = true;

pkgs/applications/science/logic/aspino/default.nix

@@ -44,5 +44,7 @@ stdenv.mkDerivation rec {
     platforms = platforms.unix;
     license = licenses.asl20;
     homepage = http://alviano.net/software/maxino/;
+    # See pkgs/applications/science/logic/glucose/default.nix
+    badPlatforms = [ "aarch64-linux" ];
   };
 }

pkgs/applications/science/logic/avy/default.nix

@@ -46,5 +46,8 @@ stdenv.mkDerivation rec {
     license     = stdenv.lib.licenses.mit;
     maintainers = with stdenv.lib.maintainers; [ thoughtpolice ];
     platforms   = stdenv.lib.platforms.linux;
+    # See pkgs/applications/science/logic/glucose/default.nix
+    # (The error is different due to glucose-fenv.patch, but the same)
+    badPlatforms = [ "aarch64-linux" ];
   };
 }

pkgs/applications/science/logic/glucose/default.nix

@@ -23,5 +23,7 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     platforms = platforms.unix;
     maintainers = with maintainers; [ gebner ];
+    # Build uses _FPU_EXTENDED macro
+    badPlatforms = [ "aarch64-linux" ];
   };
 }

pkgs/applications/science/math/R/default.nix

@@ -8,11 +8,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "R-3.5.1";
+  name = "R-3.5.2";
 
   src = fetchurl {
     url = "https://cran.r-project.org/src/base/R-3/${name}.tar.gz";
-    sha256 = "0463bff5eea0f3d93fa071f79c18d0993878fd4f2e18ae6cf22c1639d11457ed";
+    sha256 = "0qjvdic1qd5vndc4f0wjndpm0x18lbvbcc8nkix8saqgy8y8qgg5";
   };
 
   dontUseImakeConfigure = true;

pkgs/applications/version-management/git-and-tools/git-secret/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, makeWrapper, git, gnupg }:
+{ stdenv, lib, fetchFromGitHub, makeWrapper, git, gnupg, gawk }:
 
 let
   version = "0.2.4";
@@ -20,7 +20,7 @@ in stdenv.mkDerivation {
     install -D git-secret $out/bin/git-secret
 
     wrapProgram $out/bin/git-secret \
-      --prefix PATH : "${lib.makeBinPath [ git gnupg ]}"
+      --prefix PATH : "${lib.makeBinPath [ git gnupg gawk ]}"
 
     mkdir $out/share
     cp -r man $out/share

pkgs/applications/version-management/git-repo/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   name = "git-repo-${version}";
-  version = "1.13.0";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "android";
     repo = "tools_repo";
     rev = "v${version}";
-    sha256 = "0078nyz2j3ci9rs0h104xh046n0mcls3xcw5mysi2r7453xj8fkn";
+    sha256 = "09p0xv8x7mkmibri7rcl1k4dwh2gj3c7dipkrwrsir6hrwsispd1";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/version-management/gitea/default.nix

@@ -7,13 +7,13 @@ with stdenv.lib;
 
 buildGoPackage rec {
   name = "gitea-${version}";
-  version = "1.6.0";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "go-gitea";
     repo = "gitea";
     rev = "v${version}";
-    sha256 = "01nqf8pnpa0n72brqh499z15rys6f0ck7l2cnpbiqgg3kir8b21p";
+    sha256 = "1ijxpihdg8k6gs1xpim0iviqakvjadjzp0a5ki2czykilnyg8y85";
     # Required to generate the same checksum on MacOS due to unicode encoding differences
     # More information: https://github.com/NixOS/nixpkgs/pull/48128
     extraPostFetch = ''
@@ -33,7 +33,12 @@ buildGoPackage rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  buildFlags = optionalString sqliteSupport "-tags sqlite";
+  buildFlags = optional sqliteSupport "-tags sqlite";
+  buildFlagsArray = ''
+    -ldflags=
+      -X=main.Version=${version}
+      ${optionalString sqliteSupport "-X=main.Tags=sqlite"}
+  '';
 
   outputs = [ "bin" "out" "data" ];
 

pkgs/applications/version-management/mercurial/default.nix

@@ -49,8 +49,9 @@ in python2Packages.buildPythonApplication {
       cp -v hgweb.cgi contrib/hgweb.wsgi $out/share/cgi-bin
       chmod u+x $out/share/cgi-bin/hgweb.cgi
 
-      # install bash completion
+      # install bash/zsh completions
-      install -D -v contrib/bash_completion $out/share/bash-completion/completions/mercurial
+      install -v -m644 -D contrib/bash_completion $out/share/bash-completion/completions/_hg
+      install -v -m644 -D contrib/zsh_completion $out/share/zsh/site-functions/_hg
     '';
 
   meta = {

pkgs/applications/version-management/src/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "src-${version}";
-  version = "1.18";
+  version = "1.22";
 
   src = fetchurl {
     url = "http://www.catb.org/~esr/src/${name}.tar.gz";
-    sha256 = "0n0skhvya8w2az45h2gsafxy8m2mvqas64nrgxifcmrzfv0rf26c";
+    sha256 = "0xvfg3aikr2jh09vjvxsha7day5br88chvirncr59ad40da1fils";
   };
 
   buildInputs = [ python rcs git makeWrapper ];

pkgs/applications/video/vdr/default.nix

@@ -0,0 +1,78 @@
+{ stdenv, fetchurl, fontconfig, libjpeg, libcap, freetype, fribidi, pkgconfig
+, gettext, ncurses, systemd, perl
+, enableSystemd ? true
+, enableBidi ? true
+}:
+let
+
+  version = "2.4.0";
+
+  name = "vdr-${version}";
+
+  mkPlugin = name: stdenv.mkDerivation {
+    name = "vdr-${name}-${version}";
+    inherit (vdr) src;
+    buildInputs = [ vdr ];
+    preConfigure = "cd PLUGINS/src/${name}";
+    installFlags = [ "DESTDIR=$(out)" ];
+  };
+
+  vdr = stdenv.mkDerivation {
+
+    inherit name;
+
+    src = fetchurl {
+      url = "ftp://ftp.tvdr.de/vdr/${name}.tar.bz2";
+      sha256 = "1klcgy9kr7n6z8d2c77j63bl8hvhx5qnqppg73f77004hzz4kbwk";
+    };
+
+    enableParallelBuilding = true;
+
+    postPatch = "substituteInPlace Makefile --replace libsystemd-daemon libsystemd";
+
+    buildInputs = [ fontconfig libjpeg libcap freetype ]
+    ++ stdenv.lib.optional enableSystemd systemd
+    ++ stdenv.lib.optional enableBidi fribidi;
+
+    buildFlags = [ "vdr" "i18n" ]
+    ++ stdenv.lib.optional enableSystemd "SDNOTIFY=1"
+    ++ stdenv.lib.optional enableBidi "BIDI=1";
+
+    nativeBuildInputs = [ perl ];
+
+    # plugins uses the same build environment as vdr
+    propagatedNativeBuildInputs = [ pkgconfig gettext ];
+
+    installFlags = [
+      "DESTDIR=$(out)"
+      "PREFIX=" # needs to be empty, otherwise plugins try to install at same prefix
+    ];
+
+    installTargets = [ "install-pc" "install-bin" "install-doc" "install-i18n"
+      "install-includes" ];
+
+    postInstall = ''
+      mkdir -p $out/lib/vdr # only needed if vdr is started without any plugin
+      mkdir -p $out/share/vdr/conf
+      cp *.conf $out/share/vdr/conf
+      '';
+
+    outputs = [ "out" "dev" "man" ];
+
+    meta = with stdenv.lib; {
+      homepage = http://www.tvdr.de/;
+      description = "Video Disc Recorder";
+      maintainers = [ maintainers.ck3d ];
+      platforms = [ "i686-linux" "x86_64-linux" ];
+      license = licenses.gpl2;
+    };
+
+  };
+in vdr // {
+  plugins = {
+    skincurses = (mkPlugin "skincurses").overrideAttrs(
+    oldAttr: { buildInputs = oldAttr.buildInputs ++ [ ncurses ]; });
+  } // (stdenv.lib.genAttrs [
+    "epgtableid0" "hello" "osddemo" "pictures" "servicedemo" "status" "svdrpdemo"
+  ] mkPlugin);
+}

pkgs/applications/video/vdr/plugins.nix

@@ -0,0 +1,318 @@
+{ stdenv, fetchurl, fetchgit, vdr, ffmpeg_2, alsaLib, fetchFromGitHub
+, libvdpau, libxcb, xcbutilwm, graphicsmagick, libav, pcre, xorgserver, ffmpeg
+, libiconv, boost, libgcrypt, perl, utillinux, groff, libva, xorg }:
+{
+  femon = stdenv.mkDerivation rec {
+
+    name = "vdr-femon-2.4.0";
+
+    buildInputs = [ vdr ];
+
+    src = fetchurl {
+      url = "http://www.saunalahti.fi/~rahrenbe/vdr/femon/files/${name}.tgz";
+      sha256 = "1hra1xslj8s68zbyr8zdqp8yap0aj1p6rxyc6cwy1j122kwcnapp";
+    };
+
+    postPatch = "substituteInPlace Makefile --replace /bin/true true";
+
+    makeFlags = [ "DESTDIR=$(out)" ];
+
+    meta = with stdenv.lib; {
+      homepage = http://www.saunalahti.fi/~rahrenbe/vdr/femon/;
+      description = "DVB Frontend Status Monitor plugin for VDR";
+      maintainers = [ maintainers.ck3d ];
+      license = licenses.gpl2;
+      platforms = [ "i686-linux" "x86_64-linux" ];
+    };
+
+  };
+
+  vaapidevice = stdenv.mkDerivation {
+
+    name = "vdr-vaapidevice-0.7.0";
+
+    buildInputs = [
+      vdr libxcb xcbutilwm ffmpeg
+      alsaLib
+      libvdpau # vdpau
+      libva # va-api
+    ] ++ (with xorg; [ libxcb libX11 ]);
+
+    makeFlags = [ "DESTDIR=$(out)" ];
+
+    postPatch = ''
+      substituteInPlace softhddev.c --replace /usr/bin/X ${xorgserver}/bin/X
+    '';
+
+    src = fetchFromGitHub {
+      owner = "pesintta";
+      repo = "vdr-plugin-vaapidevice";
+      sha256 = "072y61fpkh3i2dragg0nsd4g3malgwxkwpdrb1ykdljyzf52s5hs";
+      rev = "c99afc23a53e6d91f9afaa99af59b30e68e626a8";
+    };
+
+    meta = with stdenv.lib; {
+      homepage = https://github.com/pesintta/vdr-plugin-vaapidevice;
+      description = "VDR SoftHDDevice Plug-in (with VA-API VPP additions)";
+      maintainers = [ maintainers.ck3d ];
+      license = licenses.gpl2;
+      platforms = [ "i686-linux" "x86_64-linux" ];
+    };
+
+  };
+
+
+  markad = stdenv.mkDerivation rec {
+    name = "vdr-markad-2017-03-13";
+
+    src = fetchgit {
+      url = "git://projects.vdr-developer.org/vdr-plugin-markad.git";
+      sha256 = "0jvy70r8bcmbs7zdqilfz019z5xkz5c6rs57h1dsgv8v6x86c2i4";
+      rev = "ea2e182ec798375f3830f8b794e7408576f139ad";
+    };
+
+    buildInputs = [ vdr libav ];
+
+    postPatch = ''
+      substituteInPlace command/Makefile --replace '$(DESTDIR)/usr' '$(DESTDIR)'
+
+      substituteInPlace plugin/markad.cpp \
+        --replace "/usr/bin" "$out/bin" \
+        --replace "/var/lib/markad" "$out/var/lib/markad"
+
+      substituteInPlace command/markad-standalone.cpp \
+        --replace "/var/lib/markad" "$out/var/lib/markad"
+    '';
+
+    preBuild = ''
+      mkdir -p $out/lib/vdr
+    '';
+
+    buildFlags = [
+      "DESTDIR=$(out)"
+      "LIBDIR=$(out)/lib/vdr"
+      "VDRDIR=${vdr.dev}/include/vdr"
+      "LOCALEDIR=$(DESTDIR)/share/locale"
+    ];
+
+    installFlags = buildFlags;
+
+    meta = with stdenv.lib; {
+      homepage = https://projects.vdr-developer.org/projects/plg-markad;
+      description = "Ein Programm zum automatischen Setzen von Schnittmarken bei Werbeeinblendungen während einer Sendung.";
+      maintainers = [ maintainers.ck3d ];
+      license = licenses.gpl2;
+      platforms = [ "i686-linux" "x86_64-linux" ];
+    };
+
+  };
+
+  epgsearch = stdenv.mkDerivation rec {
+    pname = "vdr-epgsearch";
+    version = "2.4.0";
+
+    src = fetchurl {
+      url = "https://projects.vdr-developer.org/git/vdr-plugin-epgsearch.git/snapshot/vdr-plugin-epgsearch-${version}.tar.bz2";
+      sha256 = "0xfgn17vicyjwdf0rbkrik4q16mnfi305d4wmi8f0qk825pa0z3y";
+    };
+
+    postPatch = ''
+      for f in *.sh; do
+        patchShebangs "$f"
+      done
+    '';
+
+    nativeBuildInputs = [
+      perl # for pod2man and pos2html
+      utillinux
+      groff
+    ];
+
+    buildInputs = [
+      vdr
+      pcre
+    ];
+
+    buildFlags = [
+      "SENDMAIL="
+      "REGEXLIB=pcre"
+    ];
+
+    installFlags = [
+      "DESTDIR=$(out)"
+    ];
+
+    outputs = [ "out" "man" ];
+
+    meta = with stdenv.lib; {
+      homepage = http://winni.vdr-developer.org/epgsearch;
+      description = "Searchtimer and replacement of the VDR program menu";
+      maintainers = [ maintainers.ck3d ];
+      license = licenses.gpl2;
+      platforms = [ "i686-linux" "x86_64-linux" ];
+    };
+
+  };
+
+  vnsiserver = let
+    name = "vnsiserver";
+    version = "1.8.0";
+  in stdenv.mkDerivation {
+    name = "vdr-${name}-${version}";
+
+    buildInputs = [ vdr ];
+
+    installFlags = [ "DESTDIR=$(out)" ];
+
+    src = fetchFromGitHub {
+      repo = "vdr-plugin-${name}";
+      owner = "FernetMenta";
+      rev = "v${version}";
+      sha256 = "0n7idpxqx7ayd63scl6xwdx828ik4kb2mwz0c30cfjnmnxxd45lw";
+    };
+
+    meta = with stdenv.lib; {
+      homepage = https://github.com/FernetMenta/vdr-plugin-vnsiserver;
+      description = "VDR plugin to handle KODI clients.";
+      maintainers = [ maintainers.ck3d ];
+      license = licenses.gpl2;
+      platforms = [ "i686-linux" "x86_64-linux" ];
+    };
+
+  };
+
+  text2skin = stdenv.mkDerivation rec {
+    name = "vdr-text2skin-1.3.4-20170702";
+
+    src = fetchgit {
+      url = "git://projects.vdr-developer.org/vdr-plugin-text2skin.git";
+      sha256 = "19hkwmaw6nwak38bv6cm2vcjjkf4w5yjyxb98qq6zfjjh5wq54aa";
+      rev = "8f7954da2488ced734c30e7c2704b92a44e6e1ad";
+    };
+
+    buildInputs = [ vdr graphicsmagick ];
+
+    buildFlags = [
+      "DESTDIR=$(out)"
+      "IMAGELIB=graphicsmagic"
+      "VDRDIR=${vdr.dev}/include/vdr"
+      "LOCALEDIR=$(DESTDIR)/share/locale"
+      "LIBDIR=$(DESTDIR)/lib/vdr"
+    ];
+
+    preBuild = ''
+      mkdir -p $out/lib/vdr
+    '';
+
+    installPhase = ":";
+
+    meta = with stdenv.lib; {
+      homepage = https://projects.vdr-developer.org/projects/plg-text2skin;
+      description = "VDR Text2Skin Plugin";
+      maintainers = [ maintainers.ck3d ];
+      license = licenses.gpl2;
+      platforms = [ "i686-linux" "x86_64-linux" ];
+    };
+  };
+
+  fritzbox = let
+    libconvpp = stdenv.mkDerivation {
+      name = "jowi24-libconv++-20130216";
+      propagatedBuildInputs = [ libiconv ];
+      CXXFLAGS = "-std=gnu++11 -Os";
+      src = fetchFromGitHub {
+        owner = "jowi24";
+        repo = "libconvpp";
+        rev = "90769b2216bc66c5ea5e41a929236c20d367c63b";
+        sha256 = "0bf0dwxrzd42l84p8nxcsjdk1gvzlhad93nsbn97z6kr61n4cr33";
+      };
+      installPhase = ''
+        mkdir -p $out/lib $out/include/libconv++
+        cp source.a $out/lib/libconv++.a
+        cp *.h $out/include/libconv++
+      '';
+    };
+
+    liblogpp = stdenv.mkDerivation {
+      name = "jowi24-liblogpp-20130216";
+      CXXFLAGS = "-std=gnu++11 -Os";
+      src = fetchFromGitHub {
+        owner = "jowi24";
+        repo = "liblogpp";
+        rev = "eee4046d2ae440974bcc8ceec00b069f0a2c62b9";
+        sha256 = "01aqvwmwh5kk3mncqpim8llwha9gj5qq0c4cvqfn4h8wqi3d9l3p";
+      };
+      installPhase = ''
+        mkdir -p $out/lib $out/include/liblog++
+        cp source.a $out/lib/liblog++.a
+        cp *.h $out/include/liblog++
+      '';
+    };
+
+    libnetpp = stdenv.mkDerivation {
+      name = "jowi24-libnet++-20180628";
+      CXXFLAGS = "-std=gnu++11 -Os";
+      src = fetchFromGitHub {
+        owner = "jowi24";
+        repo = "libnetpp";
+        rev = "212847f0efaeffee8422059b8e202d844174aaf3";
+        sha256 = "0vjl6ld6aj25rzxm26yjv3h2gy7gp7qnbinpw6sf1shg2xim9x0b";
+      };
+      installPhase = ''
+        mkdir -p $out/lib $out/include/libnet++
+        cp source.a $out/lib/libnet++.a
+        cp *.h $out/include/libnet++
+      '';
+      buildInputs = [ boost liblogpp libconvpp ];
+    };
+
+    libfritzpp = stdenv.mkDerivation {
+      name = "jowi24-libfritzpp-20131201";
+      CXXFLAGS = "-std=gnu++11 -Os";
+      src = fetchFromGitHub {
+        owner = "jowi24";
+        repo = "libfritzpp";
+        rev = "ca19013c9451cbac7a90155b486ea9959ced0f67";
+        sha256 = "0jk93zm3qzl9z96gfs6xl1c8ip8lckgbzibf7jay7dbgkg9kyjfg";
+      };
+      installPhase = ''
+        mkdir -p $out/lib $out/include/libfritz++
+        cp source.a $out/lib/libfritz++.a
+        cp *.h $out/include/libfritz++
+      '';
+      propagatedBuildInputs = [ libgcrypt ];
+      buildInputs = [ boost liblogpp libconvpp libnetpp ];
+    };
+
+  in stdenv.mkDerivation rec {
+    pname = "vdr-fritzbox";
+
+    version = "1.5.3";
+
+    src = fetchFromGitHub {
+      owner = "jowi24";
+      repo = "vdr-fritz";
+      rev = version;
+      sha256 = "0wab1kyma9jzhm6j33cv9hd2a5d1334ghgdi2051nmr1bdcfcsw8";
+    };
+
+    postUnpack = ''
+      cp ${libfritzpp}/lib/* $sourceRoot/libfritz++
+      cp ${liblogpp}/lib/* $sourceRoot/liblog++
+      cp ${libnetpp}/lib/* $sourceRoot/libnet++
+      cp ${libconvpp}/lib/* $sourceRoot/libconv++
+    '';
+
+    buildInputs = [ vdr boost libconvpp libfritzpp libnetpp liblogpp ];
+
+    installFlags = [ "DESTDIR=$(out)" ];
+
+    meta = with stdenv.lib; {
+      homepage = https://github.com/jowi24/vdr-fritz;
+      description = "A plugin for VDR to access AVMs Fritz Box routers";
+      maintainers = [ maintainers.ck3d ];
+      license = licenses.gpl2;
+      platforms = [ "i686-linux" "x86_64-linux" ];
+    };
+  };
+}

pkgs/applications/video/vdr/wrapper.nix

@@ -0,0 +1,21 @@
+{ symlinkJoin, lib, makeWrapper, vdr, plugins ? [] }:
+symlinkJoin {
+
+  name = "vdr-with-plugins-${(builtins.parseDrvName vdr.name).version}";
+
+  paths = [ vdr ] ++ plugins;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postBuild = ''
+    wrapProgram $out/bin/vdr --add-flags "-L $out/lib/vdr --localedir=$out/share/locale"
+  '';
+
+  meta = with vdr.meta; {
+    inherit license homepage;
+    description = description
+    + " (with plugins: "
+    + lib.concatStrings (lib.intersperse ", " (map (x: ""+x.name) plugins))
+    + ")";
+  };
+}

pkgs/applications/virtualization/firecracker/default.nix

@@ -0,0 +1,35 @@
+{ fetchurl, stdenv }:
+
+let
+  version = "0.12.0";
+  baseurl = "https://github.com/firecracker-microvm/firecracker/releases/download";
+
+  fetchbin = name: sha256: fetchurl {
+    url    = "${baseurl}/v${version}/${name}-v${version}";
+    inherit sha256;
+  };
+
+  firecracker-bin = fetchbin "firecracker" "0jk9w5kagqp3w668c1x0g4yyahmy7696pm0bkhv066rrdpcqpw66";
+  jailer-bin      = fetchbin "jailer"      "1fcxzpnapnccklgbi4bis3f6c9fki2daxvzg9l7433vfqz2zbyjl";
+in
+stdenv.mkDerivation {
+  name = "firecracker-${version}";
+  inherit version;
+
+  srcs = [ firecracker-bin jailer-bin ];
+  phases = [ "installPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    install -D ${firecracker-bin} $out/bin/firecracker
+    install -D ${jailer-bin}      $out/bin/jailer
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Secure, fast, minimal micro-container virtualization";
+    homepage    = http://firecracker-microvm.io;
+    license     = licenses.asl20;
+    platforms   = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ thoughtpolice ];
+  };
+}

pkgs/applications/virtualization/runc/default.nix

@@ -1,9 +1,9 @@
-{ stdenv, lib, fetchFromGitHub, removeReferencesTo, go-md2man
+{ stdenv, lib, fetchFromGitHub, buildGoPackage, go-md2man
-, go, pkgconfig, libapparmor, apparmor-parser, libseccomp }:
+, pkgconfig, libapparmor, apparmor-parser, libseccomp, which }:
 
 with lib;
 
-stdenv.mkDerivation rec {
+buildGoPackage rec {
   name = "runc-${version}";
   version = "1.0.0-rc6";
 
@@ -14,32 +14,26 @@ stdenv.mkDerivation rec {
     sha256 = "1jwacb8xnmx5fr86gximhbl9dlbdwj3rpf27hav9q1si86w5pb1j";
   };
 
-  outputs = [ "out" "man" ];
+  goPackagePath = "github.com/opencontainers/runc";
+  outputs = [ "bin" "out" "man" ];
 
   hardeningDisable = ["fortify"];
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ removeReferencesTo go-md2man go libseccomp libapparmor apparmor-parser ];
+  buildInputs = [ go-md2man libseccomp libapparmor apparmor-parser which ];
 
   makeFlags = ''BUILDTAGS+=seccomp BUILDTAGS+=apparmor'';
 
-  preConfigure = ''
+  buildPhase = ''
-    # Extract the source
+    cd go/src/${goPackagePath}
-    cd "$NIX_BUILD_TOP"
-    mkdir -p "go/src/github.com/opencontainers"
-    mv "$sourceRoot" "go/src/github.com/opencontainers/runc"
-    export GOPATH=$NIX_BUILD_TOP/go:$GOPATH
-  '';
-
-  preBuild = ''
-    cd go/src/github.com/opencontainers/runc
     patchShebangs .
     substituteInPlace libcontainer/apparmor/apparmor.go \
       --replace /sbin/apparmor_parser ${apparmor-parser}/bin/apparmor_parser
+    make ${makeFlags} runc
   '';
 
   installPhase = ''
-    install -Dm755 runc $out/bin/runc
+    install -Dm755 runc $bin/bin/runc
 
     # Include contributed man pages
     man/md2man-all.sh -q
@@ -55,10 +49,6 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  preFixup = ''
-    find $out/bin -type f -exec remove-references-to -t ${go} '{}' +
-  '';
-
   meta = {
     homepage = https://runc.io/;
     description = "A CLI tool for spawning and running containers according to the OCI specification";

pkgs/applications/window-managers/dwm/dwm-status.nix

@@ -9,23 +9,22 @@ in
 
 rustPlatform.buildRustPackage rec {
   name = "dwm-status-${version}";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "Gerschtli";
     repo = "dwm-status";
     rev = version;
-    sha256 = "054lwgqpx3kbrnlsqbnd8fxsawvw3nl702pf56c7dcm4sfws15nl";
+    sha256 = "0mfzpyacd7i6ipbjwyl1zc0x3lnz0f4qqzsmsb07p047z95mw4v6";
   };
 
   nativeBuildInputs = [ makeWrapper pkgconfig ];
   buildInputs = [ dbus gdk_pixbuf libnotify xorg.libX11 ];
 
-  cargoSha256 = "0wbbbk99hxxlrkm389iqni9aqvw2laarwk6hhwsr4ph3y278qhi8";
+  cargoSha256 = "1cngcacsbzijs55k4kz8fidki3p8jblk3v5s21hjsn4glzjdbkmm";
 
   postInstall = lib.optionalString enableAlsaUtils ''
-    wrapProgram $out/bin/dwm-status \
+    wrapProgram $out/bin/dwm-status --prefix "PATH" : "${binPath}"
-      --prefix "PATH" : "${binPath}"
   '';
 
   meta = with stdenv.lib; {